diff --git a/apps/mobile/src/components/agents/platform-filter-modal.tsx b/apps/mobile/src/components/agents/platform-filter-modal.tsx
index 5a3f4dea26..a12e03ab5e 100644
--- a/apps/mobile/src/components/agents/platform-filter-modal.tsx
+++ b/apps/mobile/src/components/agents/platform-filter-modal.tsx
@@ -12,6 +12,7 @@ import { cn } from '@/lib/utils';
 const PLATFORM_FILTERS = [
   'cloud-agent',
   'extension',
+  'gastown',
   'cli',
   'slack',
   'github',
@@ -80,6 +81,9 @@ function platformFilterLabel(p: string): string {
     case 'other': {
       return 'Other';
     }
+    case 'gastown': {
+      return 'Gastown';
+    }
     default: {
       return p;
     }
diff --git a/apps/web/src/app/(app)/gastown/[townId]/rigs/[rigId]/RigDetailPageClient.tsx b/apps/web/src/app/(app)/gastown/[townId]/rigs/[rigId]/RigDetailPageClient.tsx
index f7917eec57..807b329b7a 100644
--- a/apps/web/src/app/(app)/gastown/[townId]/rigs/[rigId]/RigDetailPageClient.tsx
+++ b/apps/web/src/app/(app)/gastown/[townId]/rigs/[rigId]/RigDetailPageClient.tsx
@@ -11,9 +11,11 @@ import { BeadBoard } from '@/components/gastown/BeadBoard';
 import { AgentCard } from '@/components/gastown/AgentCard';
 import { ConvoyTimeline } from '@/components/gastown/ConvoyTimeline';
 import { CreateBeadDrawer } from '@/components/gastown/CreateBeadDrawer';
+import { SlingDialog } from '@/components/gastown/SlingDialog';
 import { useDrawerStack } from '@/components/gastown/DrawerStack';
 import {
   Plus,
+  Zap,
   GitBranch,
   Hexagon,
   Bot,
@@ -42,6 +44,7 @@ export function RigDetailPageClient({
   const trpc = useGastownTRPC();
   const confirm = useConfirm();
   const [isCreateBeadOpen, setIsCreateBeadOpen] = useState(false);
+  const [isSlingOpen, setIsSlingOpen] = useState(false);
   const [convoysCollapsed, setConvoysCollapsed] = useState(false);
   const { open: openDrawer } = useDrawerStack();
 
@@ -165,6 +168,15 @@ export function RigDetailPageClient({
           >
             <Settings className="size-4" />
           </Link>
+          <Button
+            variant="secondary"
+            size="sm"
+            onClick={() => setIsSlingOpen(true)}
+            className="gap-1.5"
+          >
+            <Zap className="size-3.5" />
+            Sling
+          </Button>
           <Button
             variant="primary"
             size="sm"
@@ -322,6 +334,7 @@ export function RigDetailPageClient({
         isOpen={isCreateBeadOpen}
         onClose={() => setIsCreateBeadOpen(false)}
       />
+      <SlingDialog rigId={rigId} isOpen={isSlingOpen} onClose={() => setIsSlingOpen(false)} />
     </div>
   );
 }
diff --git a/apps/web/src/app/admin/gastown/towns/[townId]/beads/[beadId]/BeadInspectorDashboard.tsx b/apps/web/src/app/admin/gastown/towns/[townId]/beads/[beadId]/BeadInspectorDashboard.tsx
index 36a0a5f83d..3e069ff42d 100644
--- a/apps/web/src/app/admin/gastown/towns/[townId]/beads/[beadId]/BeadInspectorDashboard.tsx
+++ b/apps/web/src/app/admin/gastown/towns/[townId]/beads/[beadId]/BeadInspectorDashboard.tsx
@@ -19,7 +19,7 @@ import {
 } from '@/components/ui/alert-dialog';
 import Link from 'next/link';
 import { formatDistanceToNow, format } from 'date-fns';
-import { ArrowLeft } from 'lucide-react';
+import { ArrowLeft, Eye, Lock, Unlock } from 'lucide-react';
 
 const STATUS_COLORS: Record<string, string> = {
   open: 'bg-blue-500/10 text-blue-400 border-blue-500/20',
@@ -167,6 +167,12 @@ export function BeadInspectorDashboard({ townId, beadId }: { townId: string; bea
             {bead.status}
           </Badge>
         )}
+        {bead?.labels.includes('gt:babysit') && (
+          <Badge variant="outline" className="border-cyan-500/30 bg-cyan-500/10 text-cyan-400">
+            <Eye className="mr-1 h-3 w-3" />
+            Babysat external PR
+          </Badge>
+        )}
       </div>
 
       {beadQuery.isLoading && (
@@ -262,6 +268,54 @@ export function BeadInspectorDashboard({ townId, beadId }: { townId: string; bea
                     <dd>{bead.title}</dd>
                   </div>
                 )}
+                {bead.labels.includes('gt:babysit') && (
+                  <>
+                    {typeof bead.metadata.head_sha === 'string' && (
+                      <div>
+                        <dt className="text-muted-foreground text-xs font-medium tracking-wide uppercase">
+                          Head SHA
+                        </dt>
+                        <dd className="font-mono text-xs">{bead.metadata.head_sha.slice(0, 7)}</dd>
+                      </div>
+                    )}
+                    <div>
+                      <dt className="text-muted-foreground text-xs font-medium tracking-wide uppercase">
+                        Force-push
+                      </dt>
+                      <dd className="flex items-center gap-1 text-xs">
+                        {bead.metadata.force_push_allowed === true ? (
+                          <>
+                            <Unlock className="h-3 w-3 text-green-400" />
+                            <span className="text-green-400">Allowed</span>
+                          </>
+                        ) : (
+                          <>
+                            <Lock className="h-3 w-3 text-red-400" />
+                            <span className="text-red-400">Blocked</span>
+                          </>
+                        )}
+                      </dd>
+                    </div>
+                    {typeof bead.metadata.babysit_started_at === 'string' && (
+                      <div>
+                        <dt className="text-muted-foreground text-xs font-medium tracking-wide uppercase">
+                          Babysit started
+                        </dt>
+                        <dd
+                          title={format(
+                            new Date(bead.metadata.babysit_started_at as string),
+                            'PPpp'
+                          )}
+                        >
+                          {formatDistanceToNow(
+                            new Date(bead.metadata.babysit_started_at as string),
+                            { addSuffix: true }
+                          )}
+                        </dd>
+                      </div>
+                    )}
+                  </>
+                )}
               </dl>
             </CardContent>
           </Card>
diff --git a/apps/web/src/components/cloud-agent-next/ChatSidebar.tsx b/apps/web/src/components/cloud-agent-next/ChatSidebar.tsx
index f91ffd6946..fa28a64b0d 100644
--- a/apps/web/src/components/cloud-agent-next/ChatSidebar.tsx
+++ b/apps/web/src/components/cloud-agent-next/ChatSidebar.tsx
@@ -291,6 +291,7 @@ function SessionRow({
 const PLATFORM_FILTERS = [
   'cloud-agent',
   'extension',
+  'gastown',
   'cli',
   'slack',
   'github',
@@ -314,6 +315,8 @@ function platformFilterLabel(p: string): string {
       return 'Linear';
     case 'other':
       return 'Other';
+    case 'gastown':
+      return 'Gastown';
     default:
       return p;
   }
diff --git a/apps/web/src/components/cloud-agent-next/CloudSidebarLayout.tsx b/apps/web/src/components/cloud-agent-next/CloudSidebarLayout.tsx
index 18b2c0c0d4..8434c0952a 100644
--- a/apps/web/src/components/cloud-agent-next/CloudSidebarLayout.tsx
+++ b/apps/web/src/components/cloud-agent-next/CloudSidebarLayout.tsx
@@ -67,13 +67,13 @@ export function CloudSidebarLayout({ organizationId, children }: CloudSidebarLay
     if (platformFilter.length === 0) return undefined;
     return platformFilter.flatMap(p => {
       switch (p) {
-        // 'cloud-agent-web' is a variant of the cloud agent
         case 'cloud-agent':
           return ['cloud-agent', 'cloud-agent-web'];
         // Extension sessions are created from VS Code or agent-manager
         case 'extension':
           return ['vscode', 'agent-manager'];
         default:
+          // Handles platforms like 'gastown' by passing through unchanged
           return [p];
       }
     });
diff --git a/apps/web/src/components/gastown/ActivityFeed.test.ts b/apps/web/src/components/gastown/ActivityFeed.test.ts
new file mode 100644
index 0000000000..6144bc7090
--- /dev/null
+++ b/apps/web/src/components/gastown/ActivityFeed.test.ts
@@ -0,0 +1,95 @@
+import { describe, it, expect } from '@jest/globals';
+import { eventDescription } from './eventDescription';
+
+describe('eventDescription: babysit event types', () => {
+  const base = {
+    old_value: null,
+    new_value: null,
+    metadata: {},
+    rig_name: undefined,
+  };
+
+  it('renders babysit_started with default description', () => {
+    expect(eventDescription({ ...base, event_type: 'babysit_started' })).toBe(
+      'Babysit started — town is now monitoring this PR'
+    );
+  });
+
+  it('renders babysit_started with rig prefix', () => {
+    expect(eventDescription({ ...base, event_type: 'babysit_started', rig_name: 'my-rig' })).toBe(
+      '[my-rig] Babysit started — town is now monitoring this PR'
+    );
+  });
+
+  it('renders pr_feedback_detected without source', () => {
+    expect(eventDescription({ ...base, event_type: 'pr_feedback_detected' })).toBe(
+      'PR feedback detected'
+    );
+  });
+
+  it('renders pr_feedback_detected with source from metadata', () => {
+    expect(
+      eventDescription({
+        ...base,
+        event_type: 'pr_feedback_detected',
+        metadata: { source: 'ci-failure' },
+      })
+    ).toBe('PR feedback detected (ci-failure)');
+  });
+
+  it('renders pr_conflict_detected', () => {
+    expect(eventDescription({ ...base, event_type: 'pr_conflict_detected' })).toBe(
+      'PR merge conflict detected'
+    );
+  });
+
+  it('renders pr_auto_merge', () => {
+    expect(eventDescription({ ...base, event_type: 'pr_auto_merge' })).toBe(
+      'PR auto-merge triggered'
+    );
+  });
+
+  it('renders pr_status_changed with new_value', () => {
+    expect(
+      eventDescription({ ...base, event_type: 'pr_status_changed', new_value: 'merged' })
+    ).toBe('PR status changed: merged');
+  });
+
+  it('renders pr_status_changed without new_value', () => {
+    expect(eventDescription({ ...base, event_type: 'pr_status_changed' })).toBe(
+      'PR status changed: unknown'
+    );
+  });
+});
+
+describe('eventDescription: existing event types still work', () => {
+  const base = {
+    old_value: null,
+    new_value: null,
+    metadata: {},
+    rig_name: undefined,
+  };
+
+  it('renders created event', () => {
+    expect(
+      eventDescription({ ...base, event_type: 'created', metadata: { title: 'My Bead' } })
+    ).toBe('Bead created: My Bead');
+  });
+
+  it('renders status_changed event', () => {
+    expect(
+      eventDescription({
+        ...base,
+        event_type: 'status_changed',
+        old_value: 'open',
+        new_value: 'in_progress',
+      })
+    ).toBe('Status: open → in_progress');
+  });
+
+  it('falls through to raw event_type for unknown events', () => {
+    expect(eventDescription({ ...base, event_type: 'some_future_event' })).toBe(
+      'some_future_event'
+    );
+  });
+});
diff --git a/apps/web/src/components/gastown/ActivityFeed.tsx b/apps/web/src/components/gastown/ActivityFeed.tsx
index 36e23b1816..6501bb41b8 100644
--- a/apps/web/src/components/gastown/ActivityFeed.tsx
+++ b/apps/web/src/components/gastown/ActivityFeed.tsx
@@ -16,8 +16,13 @@ import {
   MessageSquare,
   ChevronRight,
   ShieldCheck,
+  Eye,
+  GitPullRequest as GitPullRequestIcon,
+  AlertCircle,
+  Zap,
 } from 'lucide-react';
 import { motion, AnimatePresence } from 'motion/react';
+import { eventDescription } from './eventDescription';
 
 const EVENT_ICONS: Record<string, typeof Activity> = {
   created: PlayCircle,
@@ -31,6 +36,11 @@ const EVENT_ICONS: Record<string, typeof Activity> = {
   mail_sent: Mail,
   agent_status: MessageSquare,
   triage_resolved: ShieldCheck,
+  babysit_started: Eye,
+  pr_feedback_detected: AlertCircle,
+  pr_conflict_detected: AlertTriangle,
+  pr_auto_merge: Zap,
+  pr_status_changed: GitPullRequestIcon,
 };
 
 const EVENT_COLORS: Record<string, string> = {
@@ -45,70 +55,16 @@ const EVENT_COLORS: Record<string, string> = {
   mail_sent: 'text-sky-500',
   agent_status: 'text-white/50',
   triage_resolved: 'text-amber-500',
+  babysit_started: 'text-cyan-500',
+  pr_feedback_detected: 'text-orange-500',
+  pr_conflict_detected: 'text-red-400',
+  pr_auto_merge: 'text-emerald-500',
+  pr_status_changed: 'text-purple-400',
 };
 
 type TownEvent = GastownOutputs['gastown']['getTownEvents'][number];
 type BeadEvent = GastownOutputs['gastown']['getBeadEvents'][number];
 
-function eventDescription(event: {
-  event_type: string;
-  old_value: string | null;
-  new_value: string | null;
-  metadata: Record<string, unknown>;
-  rig_name?: string;
-}): string {
-  const rigPrefix = event.rig_name ? `[${event.rig_name}] ` : '';
-  switch (event.event_type) {
-    case 'created': {
-      const title = event.metadata?.title;
-      return `${rigPrefix}Bead created: ${typeof title === 'string' ? title : (event.new_value ?? 'unknown')}`;
-    }
-    case 'hooked':
-      return `${rigPrefix}Agent hooked to bead`;
-    case 'unhooked':
-      return `${rigPrefix}Agent unhooked from bead`;
-    case 'status_changed': {
-      const desc = `${rigPrefix}Status: ${event.old_value ?? '?'} → ${event.new_value ?? '?'}`;
-      if (event.new_value === 'failed') {
-        const fr = event.metadata?.failure_reason;
-        if (typeof fr === 'object' && fr !== null && 'message' in fr) {
-          const msg = (fr as Record<string, unknown>).message;
-          if (typeof msg === 'string') return `${desc} — ${msg}`;
-        }
-      }
-      return desc;
-    }
-    case 'closed':
-      return `${rigPrefix}Bead closed`;
-    case 'escalated':
-      return `${rigPrefix}Escalation created`;
-    case 'review_submitted':
-      return `${rigPrefix}Submitted for review: ${event.new_value ?? ''}`;
-    case 'review_completed':
-      return `${rigPrefix}Review ${event.new_value ?? 'completed'}`;
-    case 'mail_sent':
-      return `${rigPrefix}Mail sent`;
-    case 'triage_resolved': {
-      const action = event.new_value ?? (event.metadata?.action as string | undefined) ?? 'unknown';
-      const notes = event.metadata?.resolution_notes as string | undefined;
-      const desc = `${rigPrefix}Triage: ${action}`;
-      return notes ? `${desc} — ${notes}` : desc;
-    }
-    case 'agent_status': {
-      const msg = event.new_value ?? (event.metadata?.message as string | undefined);
-      const agentName = event.metadata?.agent_name as string | undefined;
-      const rigName = event.metadata?.rig_name as string | undefined;
-      const body = msg ?? 'Agent status update';
-      // Prefer metadata rig_name over the top-level rig_name (which is
-      // never populated for bead_events rows).
-      const prefix = rigName ? `[${rigName}] ` : rigPrefix;
-      return agentName ? `${prefix}${agentName}: ${body}` : `${prefix}${body}`;
-    }
-    default:
-      return `${rigPrefix}${event.event_type}`;
-  }
-}
-
 function toEventDescriptionInput(event: TownEvent | BeadEvent) {
   return {
     event_type: event.event_type,
diff --git a/apps/web/src/components/gastown/BabysitPrPanel.test.ts b/apps/web/src/components/gastown/BabysitPrPanel.test.ts
new file mode 100644
index 0000000000..ac9fb17821
--- /dev/null
+++ b/apps/web/src/components/gastown/BabysitPrPanel.test.ts
@@ -0,0 +1,224 @@
+import { describe, it, expect } from '@jest/globals';
+
+const HTTPS_URL_RE = /^https:\/\/.+/;
+
+type PreviewPrResult = {
+  state: string;
+  head_branch?: string;
+  base_branch?: string;
+  head_sha?: string;
+  title?: string;
+  repo_matches: boolean;
+};
+
+function validatePrUrl(url: string): boolean {
+  return HTTPS_URL_RE.test(url.trim());
+}
+
+function getPreviewStatus(preview: PreviewPrResult | null | undefined): {
+  isRepoMismatch: boolean;
+  isPrClosed: boolean;
+  isPreviewReady: boolean;
+} {
+  if (!preview) {
+    return { isRepoMismatch: false, isPrClosed: false, isPreviewReady: false };
+  }
+  const isRepoMismatch = !preview.repo_matches;
+  const isPrClosed =
+    preview.repo_matches && preview.state !== 'open' && preview.state !== 'unknown';
+  const isPreviewReady = preview.repo_matches && preview.state === 'open';
+  return { isRepoMismatch, isPrClosed, isPreviewReady };
+}
+
+function canSubmit(isValidUrl: boolean, isPreviewReady: boolean): boolean {
+  return isValidUrl && isPreviewReady;
+}
+
+function buildMutationArgs(
+  rigId: string,
+  prUrl: string,
+  titleOverride: string,
+  bodyOverride: string,
+  forcePushAllowed: boolean
+) {
+  return {
+    rigId,
+    prUrl: prUrl.trim(),
+    title: titleOverride.trim() || undefined,
+    body: bodyOverride.trim() || undefined,
+    forcePushAllowed,
+  };
+}
+
+function getDefaultTitle(preview: PreviewPrResult | null | undefined): string {
+  return preview?.title ? `Babysit: ${preview.title}` : '';
+}
+
+function getDefaultBody(preview: PreviewPrResult | null | undefined, prUrl: string): string {
+  return preview ? `Monitoring PR: ${prUrl.trim()}` : '';
+}
+
+describe('BabysitPrPanel: URL validation', () => {
+  it('rejects empty string', () => {
+    expect(validatePrUrl('')).toBe(false);
+  });
+
+  it('rejects non-https URL', () => {
+    expect(validatePrUrl('http://github.com/owner/repo/pull/1')).toBe(false);
+  });
+
+  it('rejects plain text', () => {
+    expect(validatePrUrl('not a url')).toBe(false);
+  });
+
+  it('accepts valid https GitHub PR URL', () => {
+    expect(validatePrUrl('https://github.com/owner/repo/pull/123')).toBe(true);
+  });
+
+  it('accepts valid https GitLab MR URL', () => {
+    expect(validatePrUrl('https://gitlab.com/owner/repo/-/merge_requests/1')).toBe(true);
+  });
+
+  it('trims whitespace before validating', () => {
+    expect(validatePrUrl('  https://github.com/owner/repo/pull/1  ')).toBe(true);
+  });
+
+  it('submit is disabled with invalid URL', () => {
+    expect(canSubmit(false, false)).toBe(false);
+    expect(canSubmit(false, true)).toBe(false);
+  });
+});
+
+describe('BabysitPrPanel: preview status', () => {
+  it('repo_matches: false → isRepoMismatch, submit disabled', () => {
+    const preview: PreviewPrResult = { state: 'unknown', repo_matches: false };
+    const status = getPreviewStatus(preview);
+    expect(status.isRepoMismatch).toBe(true);
+    expect(status.isPreviewReady).toBe(false);
+    expect(canSubmit(true, status.isPreviewReady)).toBe(false);
+  });
+
+  it('PR state "closed" → isPrClosed, submit disabled', () => {
+    const preview: PreviewPrResult = {
+      state: 'closed',
+      head_branch: 'feature/x',
+      base_branch: 'main',
+      title: 'My PR',
+      repo_matches: true,
+    };
+    const status = getPreviewStatus(preview);
+    expect(status.isPrClosed).toBe(true);
+    expect(status.isPreviewReady).toBe(false);
+    expect(canSubmit(true, status.isPreviewReady)).toBe(false);
+  });
+
+  it('PR state "merged" → isPrClosed, submit disabled', () => {
+    const preview: PreviewPrResult = {
+      state: 'merged',
+      repo_matches: true,
+    };
+    const status = getPreviewStatus(preview);
+    expect(status.isPrClosed).toBe(true);
+    expect(status.isPreviewReady).toBe(false);
+  });
+
+  it('PR state "open" with repo_matches → isPreviewReady, submit enabled', () => {
+    const preview: PreviewPrResult = {
+      state: 'open',
+      head_branch: 'feature/x',
+      base_branch: 'main',
+      head_sha: 'abc1234',
+      title: 'My PR',
+      repo_matches: true,
+    };
+    const status = getPreviewStatus(preview);
+    expect(status.isRepoMismatch).toBe(false);
+    expect(status.isPrClosed).toBe(false);
+    expect(status.isPreviewReady).toBe(true);
+    expect(canSubmit(true, status.isPreviewReady)).toBe(true);
+  });
+
+  it('null preview → all statuses false, submit disabled', () => {
+    const status = getPreviewStatus(null);
+    expect(status.isRepoMismatch).toBe(false);
+    expect(status.isPrClosed).toBe(false);
+    expect(status.isPreviewReady).toBe(false);
+    expect(canSubmit(true, status.isPreviewReady)).toBe(false);
+  });
+});
+
+describe('BabysitPrPanel: mutation args', () => {
+  it('happy path: builds correct mutation args with defaults', () => {
+    const args = buildMutationArgs(
+      'rig-1',
+      'https://github.com/owner/repo/pull/123',
+      '',
+      '',
+      false
+    );
+    expect(args).toEqual({
+      rigId: 'rig-1',
+      prUrl: 'https://github.com/owner/repo/pull/123',
+      title: undefined,
+      body: undefined,
+      forcePushAllowed: false,
+    });
+  });
+
+  it('plumbs forcePushAllowed through to mutation', () => {
+    const args = buildMutationArgs('rig-1', 'https://github.com/owner/repo/pull/123', '', '', true);
+    expect(args.forcePushAllowed).toBe(true);
+  });
+
+  it('uses title and body overrides when provided', () => {
+    const args = buildMutationArgs(
+      'rig-1',
+      'https://github.com/owner/repo/pull/123',
+      'Custom title',
+      'Custom body',
+      false
+    );
+    expect(args.title).toBe('Custom title');
+    expect(args.body).toBe('Custom body');
+  });
+
+  it('trims whitespace from overrides', () => {
+    const args = buildMutationArgs(
+      'rig-1',
+      '  https://github.com/owner/repo/pull/123  ',
+      '  Custom title  ',
+      '  Custom body  ',
+      false
+    );
+    expect(args.prUrl).toBe('https://github.com/owner/repo/pull/123');
+    expect(args.title).toBe('Custom title');
+    expect(args.body).toBe('Custom body');
+  });
+});
+
+describe('BabysitPrPanel: default values', () => {
+  it('default title is "Babysit: <PR title>" when preview has title', () => {
+    const preview: PreviewPrResult = {
+      state: 'open',
+      title: 'Fix login bug',
+      repo_matches: true,
+    };
+    expect(getDefaultTitle(preview)).toBe('Babysit: Fix login bug');
+  });
+
+  it('default title is empty when preview has no title', () => {
+    const preview: PreviewPrResult = { state: 'open', repo_matches: true };
+    expect(getDefaultTitle(preview)).toBe('');
+  });
+
+  it('default body is "Monitoring PR: <url>" when preview exists', () => {
+    const preview: PreviewPrResult = { state: 'open', repo_matches: true };
+    expect(getDefaultBody(preview, 'https://github.com/o/r/pull/1')).toBe(
+      'Monitoring PR: https://github.com/o/r/pull/1'
+    );
+  });
+
+  it('default body is empty when no preview', () => {
+    expect(getDefaultBody(null, 'https://github.com/o/r/pull/1')).toBe('');
+  });
+});
diff --git a/apps/web/src/components/gastown/BabysitPrPanel.tsx b/apps/web/src/components/gastown/BabysitPrPanel.tsx
new file mode 100644
index 0000000000..1f4068e17e
--- /dev/null
+++ b/apps/web/src/components/gastown/BabysitPrPanel.tsx
@@ -0,0 +1,289 @@
+'use client';
+
+import { useState, useEffect, useRef, useCallback } from 'react';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useGastownTRPC } from '@/lib/gastown/trpc';
+import { Input } from '@/components/ui/input';
+import { Textarea } from '@/components/ui/textarea';
+import { Button } from '@/components/Button';
+import { Badge } from '@/components/ui/badge';
+import { toast } from 'sonner';
+import { ExternalLink, GitBranch, GitPullRequest, Loader2, AlertTriangle } from 'lucide-react';
+
+type BabysitPrPanelProps = {
+  rigId: string;
+  onClose: () => void;
+};
+
+const HTTPS_URL_RE = /^https:\/\/.+/;
+
+export type PreviewPrResult = {
+  state: string;
+  head_branch?: string;
+  base_branch?: string;
+  head_sha?: string;
+  title?: string;
+  repo_matches: boolean;
+};
+
+export function BabysitPrPanel({ rigId, onClose }: BabysitPrPanelProps) {
+  const trpc = useGastownTRPC();
+  const queryClient = useQueryClient();
+
+  const [prUrl, setPrUrl] = useState('');
+  const [debouncedUrl, setDebouncedUrl] = useState('');
+  const [titleOverride, setTitleOverride] = useState('');
+  const [bodyOverride, setBodyOverride] = useState('');
+  const [forcePushAllowed, setForcePushAllowed] = useState(false);
+  const [userEditedTitle, setUserEditedTitle] = useState(false);
+  const [userEditedBody, setUserEditedBody] = useState(false);
+  const debounceRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  useEffect(() => {
+    if (debounceRef.current) {
+      clearTimeout(debounceRef.current);
+    }
+    if (!prUrl.trim() || !HTTPS_URL_RE.test(prUrl.trim())) {
+      setDebouncedUrl('');
+      return;
+    }
+    debounceRef.current = setTimeout(() => {
+      setDebouncedUrl(prUrl.trim());
+    }, 500);
+    return () => {
+      if (debounceRef.current) {
+        clearTimeout(debounceRef.current);
+      }
+    };
+  }, [prUrl]);
+
+  const previewQuery = useQuery(
+    trpc.gastown.previewPr.queryOptions(
+      { rigId, prUrl: debouncedUrl },
+      {
+        enabled: debouncedUrl.length > 0,
+        retry: false,
+      }
+    )
+  );
+
+  const preview = previewQuery.data as PreviewPrResult | undefined;
+  const previewError = previewQuery.error;
+  const defaultTitle = preview?.title ? `Babysit: ${preview.title}` : '';
+  const defaultBody = preview ? `Monitoring PR: ${prUrl.trim()}` : '';
+
+  useEffect(() => {
+    if (!userEditedTitle) setTitleOverride(defaultTitle);
+  }, [defaultTitle, userEditedTitle]);
+
+  useEffect(() => {
+    if (!userEditedBody) setBodyOverride(defaultBody);
+  }, [defaultBody, userEditedBody]);
+
+  const isValidUrl = HTTPS_URL_RE.test(prUrl.trim());
+  const isPreviewReady = !!preview && preview.repo_matches && preview.state === 'open';
+  const isRepoMismatch = !!preview && !preview.repo_matches;
+  const isPrClosed =
+    !!preview && preview.repo_matches && preview.state !== 'open' && preview.state !== 'unknown';
+
+  const babysitPr = useMutation(
+    trpc.gastown.babysitPr.mutationOptions({
+      onSuccess: result => {
+        void queryClient.invalidateQueries({ queryKey: trpc.gastown.listBeads.queryKey() });
+        void queryClient.invalidateQueries({ queryKey: trpc.gastown.listAgents.queryKey() });
+        void queryClient.invalidateQueries({ queryKey: trpc.gastown.getRig.queryKey() });
+        const msg = result.warning
+          ? `Babysit started — ${result.warning}`
+          : 'Babysit started — PR will be polled automatically';
+        toast.success(msg);
+        onClose();
+      },
+      onError: err => {
+        toast.error(err.message);
+      },
+    })
+  );
+
+  const handleSubmit = useCallback(
+    (e: React.FormEvent) => {
+      e.preventDefault();
+      if (!isPreviewReady) return;
+      babysitPr.mutate({
+        rigId,
+        prUrl: prUrl.trim(),
+        title: titleOverride.trim() || undefined,
+        body: bodyOverride.trim() || undefined,
+        forcePushAllowed,
+      });
+    },
+    [isPreviewReady, babysitPr, rigId, prUrl, titleOverride, bodyOverride, forcePushAllowed]
+  );
+
+  return (
+    <form onSubmit={handleSubmit}>
+      <div className="space-y-4 py-4">
+        <div>
+          <label className="mb-2 block text-sm font-medium text-white/70">PR URL</label>
+          <Input
+            value={prUrl}
+            onChange={e => setPrUrl(e.target.value)}
+            placeholder="https://github.com/owner/repo/pull/123"
+            autoFocus
+            className="border-white/10 bg-black/25"
+          />
+          {prUrl && !isValidUrl && (
+            <p className="mt-1 text-xs text-red-400">Enter a valid https:// URL</p>
+          )}
+        </div>
+
+        {previewQuery.isLoading && debouncedUrl && (
+          <div className="flex items-center gap-2 text-xs text-white/40">
+            <Loader2 className="size-3 animate-spin" />
+            Loading PR preview...
+          </div>
+        )}
+
+        {previewError && debouncedUrl && !previewQuery.isLoading && (
+          <div className="rounded-md border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-400">
+            Failed to load PR preview: {previewError.message}
+          </div>
+        )}
+
+        {isRepoMismatch && (
+          <div className="rounded-md border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-xs text-amber-300">
+            <div className="flex items-center gap-1.5">
+              <AlertTriangle className="size-3.5 shrink-0" />
+              This PR belongs to a different repository than the rig. Cannot babysit.
+            </div>
+          </div>
+        )}
+
+        {isPrClosed && (
+          <div className="rounded-md border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-xs text-amber-300">
+            <div className="flex items-center gap-1.5">
+              <AlertTriangle className="size-3.5 shrink-0" />
+              This PR is {preview.state}. Only open PRs can be babysat.
+            </div>
+          </div>
+        )}
+
+        {preview && preview.repo_matches && preview.state !== 'unknown' && !isRepoMismatch && (
+          <div className="rounded-md border border-white/[0.08] bg-white/[0.03] px-3 py-2.5">
+            <div className="flex items-center justify-between gap-2">
+              <div className="min-w-0 flex-1">
+                <div className="flex items-center gap-1.5">
+                  <GitPullRequest className="size-3.5 shrink-0 text-[color:oklch(95%_0.15_108)]" />
+                  <span className="truncate text-sm font-medium text-white/90">
+                    {preview.title ?? 'Untitled PR'}
+                  </span>
+                </div>
+                <div className="mt-1 flex items-center gap-2 text-[11px] text-white/40">
+                  {preview.head_branch && (
+                    <span className="inline-flex items-center gap-0.5">
+                      <GitBranch className="size-3" />
+                      {preview.head_branch}
+                    </span>
+                  )}
+                  {preview.head_branch && preview.base_branch && <span>&rarr;</span>}
+                  {preview.base_branch && <span>{preview.base_branch}</span>}
+                </div>
+              </div>
+              <Badge
+                variant="outline"
+                className={`shrink-0 text-[10px] ${
+                  preview.state === 'open'
+                    ? 'border-emerald-500/30 text-emerald-400'
+                    : 'border-white/10 text-white/50'
+                }`}
+              >
+                {preview.state}
+              </Badge>
+            </div>
+            <a
+              href={prUrl}
+              target="_blank"
+              rel="noopener noreferrer"
+              className="mt-1.5 inline-flex items-center gap-1 text-[11px] text-[color:oklch(95%_0.15_108)] hover:underline"
+            >
+              <ExternalLink className="size-3" />
+              View Pull Request
+            </a>
+          </div>
+        )}
+
+        <div>
+          <label className="mb-2 block text-sm font-medium text-white/70">
+            Title override (optional)
+          </label>
+          <Input
+            value={titleOverride}
+            onChange={e => {
+              setTitleOverride(e.target.value);
+              setUserEditedTitle(true);
+            }}
+            placeholder={defaultTitle || 'Babysit: <PR title>'}
+            className="border-white/10 bg-black/25"
+          />
+        </div>
+
+        <div>
+          <label className="mb-2 block text-sm font-medium text-white/70">
+            Body override (optional)
+          </label>
+          <Textarea
+            value={bodyOverride}
+            onChange={e => {
+              setBodyOverride(e.target.value);
+              setUserEditedBody(true);
+            }}
+            placeholder={defaultBody || 'Monitoring PR: <url>'}
+            rows={3}
+            className="border-white/10 bg-black/25"
+          />
+        </div>
+
+        <div>
+          <label className="flex cursor-pointer items-start gap-2.5">
+            <input
+              type="checkbox"
+              checked={forcePushAllowed}
+              onChange={e => setForcePushAllowed(e.target.checked)}
+              className="mt-0.5 size-4 cursor-pointer rounded border-white/20 bg-white/5 accent-[color:oklch(0.95_0.15_108)]"
+            />
+            <div>
+              <span className="text-sm text-white/75">Allow force-push</span>
+              <p className="mt-0.5 text-xs text-white/35">
+                Allow polecats to force-push to the PR branch when fixing conflicts or addressing
+                review comments. Only check this if you own the branch or the PR author has
+                explicitly consented. When unchecked, polecats will use merge commits and regular
+                pushes only.
+              </p>
+            </div>
+          </label>
+        </div>
+      </div>
+
+      <div className="flex justify-end gap-2">
+        <Button variant="secondary" size="md" type="button" onClick={onClose}>
+          Cancel
+        </Button>
+        <Button
+          variant="primary"
+          size="md"
+          type="submit"
+          disabled={!isValidUrl || !isPreviewReady || babysitPr.isPending}
+          className="bg-[color:oklch(95%_0.15_108_/_0.90)] text-black hover:bg-[color:oklch(95%_0.15_108_/_0.95)]"
+        >
+          {babysitPr.isPending ? (
+            <>
+              <Loader2 className="mr-1.5 size-3.5 animate-spin" />
+              Starting...
+            </>
+          ) : (
+            'Babysit PR'
+          )}
+        </Button>
+      </div>
+    </form>
+  );
+}
diff --git a/apps/web/src/components/gastown/SlingDialog.tsx b/apps/web/src/components/gastown/SlingDialog.tsx
index a63e64685c..8cf4f06501 100644
--- a/apps/web/src/components/gastown/SlingDialog.tsx
+++ b/apps/web/src/components/gastown/SlingDialog.tsx
@@ -1,15 +1,10 @@
 'use client';
 
-import { useState } from 'react';
+import { useState, useEffect } from 'react';
 import { useMutation, useQueryClient } from '@tanstack/react-query';
 import { useGastownTRPC } from '@/lib/gastown/trpc';
-import {
-  Dialog,
-  DialogContent,
-  DialogHeader,
-  DialogTitle,
-  DialogFooter,
-} from '@/components/ui/dialog';
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { Tabs, TabsList, TabsTrigger, TabsContent } from '@/components/ui/tabs';
 import { Input } from '@/components/ui/input';
 import { Textarea } from '@/components/ui/textarea';
 import {
@@ -20,6 +15,7 @@ import {
   SelectValue,
 } from '@/components/ui/select';
 import { Button } from '@/components/Button';
+import { BabysitPrPanel } from '@/components/gastown/BabysitPrPanel';
 import { toast } from 'sonner';
 
 type SlingDialogProps = {
@@ -36,13 +32,44 @@ const MODEL_OPTIONS = [
   { value: 'kilo/gemini-2.5-pro', label: 'Gemini 2.5 Pro' },
 ];
 
+const TAB_STORAGE_KEY = 'sling-dialog-last-tab';
+
+function getStoredTab(): string {
+  if (typeof window === 'undefined') return 'sling';
+  try {
+    return localStorage.getItem(TAB_STORAGE_KEY) ?? 'sling';
+  } catch {
+    return 'sling';
+  }
+}
+
+function storeTab(tab: string) {
+  try {
+    localStorage.setItem(TAB_STORAGE_KEY, tab);
+  } catch {
+    // Storage may be unavailable in privacy-restricted browser contexts.
+  }
+}
+
 export function SlingDialog({ rigId, isOpen, onClose }: SlingDialogProps) {
+  const [activeTab, setActiveTab] = useState(getStoredTab);
   const [title, setTitle] = useState('');
   const [body, setBody] = useState('');
   const [model, setModel] = useState(MODEL_OPTIONS[0].value);
   const trpc = useGastownTRPC();
   const queryClient = useQueryClient();
 
+  useEffect(() => {
+    if (isOpen) {
+      setActiveTab(getStoredTab());
+    }
+  }, [isOpen]);
+
+  const handleTabChange = (tab: string) => {
+    setActiveTab(tab);
+    storeTab(tab);
+  };
+
   const sling = useMutation(
     trpc.gastown.sling.mutationOptions({
       onSuccess: result => {
@@ -78,61 +105,76 @@ export function SlingDialog({ rigId, isOpen, onClose }: SlingDialogProps) {
         <DialogHeader>
           <DialogTitle>Sling Work</DialogTitle>
         </DialogHeader>
-        <form onSubmit={handleSubmit}>
-          <div className="space-y-4 py-4">
-            <div>
-              <label className="mb-2 block text-sm font-medium text-white/70">Title</label>
-              <Input
-                value={title}
-                onChange={e => setTitle(e.target.value)}
-                placeholder="What needs to be done?"
-                autoFocus
-                className="border-white/10 bg-black/25"
-              />
-            </div>
-            <div>
-              <label className="mb-2 block text-sm font-medium text-white/70">
-                Description (optional)
-              </label>
-              <Textarea
-                value={body}
-                onChange={e => setBody(e.target.value)}
-                placeholder="Additional context or requirements..."
-                rows={4}
-                className="border-white/10 bg-black/25"
-              />
-            </div>
-            <div>
-              <label className="mb-2 block text-sm font-medium text-white/70">Model</label>
-              <Select value={model} onValueChange={setModel}>
-                <SelectTrigger>
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent>
-                  {MODEL_OPTIONS.map(opt => (
-                    <SelectItem key={opt.value} value={opt.value}>
-                      {opt.label}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-            </div>
-          </div>
-          <DialogFooter>
-            <Button variant="secondary" size="md" type="button" onClick={onClose}>
-              Cancel
-            </Button>
-            <Button
-              variant="primary"
-              size="md"
-              type="submit"
-              disabled={!title.trim() || sling.isPending}
-              className="bg-[color:oklch(95%_0.15_108_/_0.90)] text-black hover:bg-[color:oklch(95%_0.15_108_/_0.95)]"
-            >
-              {sling.isPending ? 'Slinging...' : 'Sling'}
-            </Button>
-          </DialogFooter>
-        </form>
+        <Tabs value={activeTab} onValueChange={handleTabChange}>
+          <TabsList className="mb-2 w-full">
+            <TabsTrigger value="sling" className="flex-1">
+              Sling work
+            </TabsTrigger>
+            <TabsTrigger value="babysit" className="flex-1">
+              Babysit existing PR
+            </TabsTrigger>
+          </TabsList>
+          <TabsContent value="sling">
+            <form onSubmit={handleSubmit}>
+              <div className="space-y-4 py-4">
+                <div>
+                  <label className="mb-2 block text-sm font-medium text-white/70">Title</label>
+                  <Input
+                    value={title}
+                    onChange={e => setTitle(e.target.value)}
+                    placeholder="What needs to be done?"
+                    autoFocus={activeTab === 'sling'}
+                    className="border-white/10 bg-black/25"
+                  />
+                </div>
+                <div>
+                  <label className="mb-2 block text-sm font-medium text-white/70">
+                    Description (optional)
+                  </label>
+                  <Textarea
+                    value={body}
+                    onChange={e => setBody(e.target.value)}
+                    placeholder="Additional context or requirements..."
+                    rows={4}
+                    className="border-white/10 bg-black/25"
+                  />
+                </div>
+                <div>
+                  <label className="mb-2 block text-sm font-medium text-white/70">Model</label>
+                  <Select value={model} onValueChange={setModel}>
+                    <SelectTrigger>
+                      <SelectValue />
+                    </SelectTrigger>
+                    <SelectContent>
+                      {MODEL_OPTIONS.map(opt => (
+                        <SelectItem key={opt.value} value={opt.value}>
+                          {opt.label}
+                        </SelectItem>
+                      ))}
+                    </SelectContent>
+                  </Select>
+                </div>
+              </div>
+              <div className="flex justify-end gap-2">
+                <Button variant="secondary" size="md" type="button" onClick={onClose}>
+                  Cancel
+                </Button>
+                <Button
+                  variant="primary"
+                  size="md"
+                  type="submit"
+                  disabled={!title.trim() || sling.isPending}
+                  className="bg-[color:oklch(95%_0.15_108_/_0.90)] text-black hover:bg-[color:oklch(95%_0.15_108_/_0.95)]"
+                >
+                  {sling.isPending ? 'Slinging...' : 'Sling'}
+                </Button>
+              </div>
+            </form>
+          </TabsContent>
+          <TabsContent value="babysit">
+            <BabysitPrPanel rigId={rigId} onClose={onClose} />
+          </TabsContent>
+        </Tabs>
       </DialogContent>
     </Dialog>
   );
diff --git a/apps/web/src/components/gastown/drawer-panels/BeadPanel.test.ts b/apps/web/src/components/gastown/drawer-panels/BeadPanel.test.ts
new file mode 100644
index 0000000000..6dc65bb0a8
--- /dev/null
+++ b/apps/web/src/components/gastown/drawer-panels/BeadPanel.test.ts
@@ -0,0 +1,94 @@
+import { describe, it, expect } from '@jest/globals';
+import { buildRelatedBeads, type BeadLike } from './buildRelatedBeads';
+
+const makeBead = (
+  overrides: Partial<BeadLike> & Pick<BeadLike, 'bead_id' | 'type' | 'title'>
+): BeadLike => ({
+  status: 'open',
+  parent_bead_id: null,
+  rig_id: null,
+  metadata: {},
+  ...overrides,
+});
+
+describe('buildRelatedBeads: babysit source bead filtering', () => {
+  const sourceBead = makeBead({ bead_id: 'source-1', type: 'issue', title: 'Source Work' });
+
+  it('includes source bead for non-babysit merge_request beads with source_bead_id', () => {
+    const babysitBead = makeBead({
+      bead_id: 'mr-1',
+      type: 'merge_request',
+      title: 'MR without babysit',
+      metadata: { source_bead_id: 'source-1' },
+    });
+    const related = buildRelatedBeads(babysitBead, [babysitBead, sourceBead], []);
+    const sourceRelation = related.find(r => r.relation === 'source');
+    expect(sourceRelation).toBeDefined();
+    expect(sourceRelation?.bead.bead_id).toBe('source-1');
+  });
+
+  it('excludes source bead for babysit beads (filtered by caller)', () => {
+    const babysitBead = makeBead({
+      bead_id: 'mr-2',
+      type: 'merge_request',
+      title: 'Babysat MR',
+      metadata: { source_bead_id: 'source-1' },
+    });
+    const related = buildRelatedBeads(babysitBead, [babysitBead, sourceBead], []);
+    const isBabysit = true;
+    const filtered = related.filter(r => !(r.relation === 'source' && isBabysit));
+    expect(filtered.find(r => r.relation === 'source')).toBeUndefined();
+  });
+
+  it('includes child beads regardless of babysit status', () => {
+    const babysitBead = makeBead({
+      bead_id: 'mr-3',
+      type: 'merge_request',
+      title: 'Babysat MR',
+    });
+    const childBead = makeBead({
+      bead_id: 'child-1',
+      type: 'issue',
+      title: 'Child issue',
+      parent_bead_id: 'mr-3',
+    });
+    const related = buildRelatedBeads(babysitBead, [babysitBead, childBead], []);
+    const childRelation = related.find(r => r.relation === 'child');
+    expect(childRelation).toBeDefined();
+    expect(childRelation?.bead.bead_id).toBe('child-1');
+  });
+});
+
+describe('babysit badge detection logic', () => {
+  it('detects gt:babysit label', () => {
+    const labels = ['gt:merge-request', 'gt:babysit'];
+    expect(labels.includes('gt:babysit')).toBe(true);
+  });
+
+  it('does not detect gt:babysit when absent', () => {
+    const labels = ['gt:merge-request'];
+    expect(labels.includes('gt:babysit')).toBe(false);
+  });
+});
+
+describe('babysit metadata extraction', () => {
+  it('extracts head_sha from metadata', () => {
+    const metadata: Record<string, unknown> = { head_sha: 'abc1234def5678' };
+    expect(typeof metadata.head_sha).toBe('string');
+    expect((metadata.head_sha as string).slice(0, 7)).toBe('abc1234');
+  });
+
+  it('extracts force_push_allowed from metadata', () => {
+    const metaTrue: Record<string, unknown> = { force_push_allowed: true };
+    const metaFalse: Record<string, unknown> = { force_push_allowed: false };
+    const metaMissing: Record<string, unknown> = {};
+    expect(metaTrue.force_push_allowed).toBe(true);
+    expect(metaFalse.force_push_allowed).toBe(false);
+    expect(metaMissing.force_push_allowed).toBeUndefined();
+  });
+
+  it('extracts babysit_started_at from metadata', () => {
+    const metadata: Record<string, unknown> = { babysit_started_at: '2026-05-28T12:00:00Z' };
+    expect(typeof metadata.babysit_started_at).toBe('string');
+  });
+});
diff --git a/apps/web/src/components/gastown/drawer-panels/BeadPanel.tsx b/apps/web/src/components/gastown/drawer-panels/BeadPanel.tsx
index 6f76f96b92..286b90107c 100644
--- a/apps/web/src/components/gastown/drawer-panels/BeadPanel.tsx
+++ b/apps/web/src/components/gastown/drawer-panels/BeadPanel.tsx
@@ -1,6 +1,6 @@
 'use client';
 
-import { useState, useCallback } from 'react';
+import { useState, useCallback, type ReactNode } from 'react';
 import { usePathname } from 'next/navigation';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import { useGastownTRPC } from '@/lib/gastown/trpc';
@@ -11,6 +11,7 @@ import { Textarea } from '@/components/ui/textarea';
 import { BeadEventTimeline, extractPrUrl } from '@/components/gastown/ActivityFeed';
 import type { ResourceRef } from '@/components/gastown/DrawerStack';
 import { WastelandOriginLink } from './WastelandOriginLink';
+import { buildRelatedBeads } from './buildRelatedBeads';
 
 import { format, formatDistanceToNow } from 'date-fns';
 import {
@@ -26,10 +27,6 @@ import {
   ChevronRight,
   Bot,
   Network,
-  ArrowDownRight,
-  ArrowUpRight,
-  GitPullRequest,
-  CircleDot,
   Layers,
   Pencil,
   X,
@@ -37,6 +34,9 @@ import {
   Loader2,
   Play,
   MessageCircle,
+  Lock,
+  Unlock,
+  Eye,
 } from 'lucide-react';
 import ReactMarkdown from 'react-markdown';
 import remarkGfm from 'remark-gfm';
@@ -244,10 +244,15 @@ export function BeadPanel({
   // Only allow https:// URLs to prevent XSS via javascript: protocol injection.
   const prUrl = extractPrUrl(bead.metadata);
 
+  // Babysit bead detection (must be before relatedBeads to avoid TDZ)
+  const isBabysit = bead.labels.includes('gt:babysit');
+
   // Build related beads from the flat list and convoy DAG data
   const allBeads = beadsQuery.data ?? [];
   const convoys = convoysQuery.data ?? [];
-  const relatedBeads = buildRelatedBeads(bead, allBeads, convoys);
+  const relatedBeads = buildRelatedBeads(bead, allBeads, convoys).filter(
+    r => !(r.relation === 'source' && isBabysit)
+  );
 
   // Find parent convoy for metadata display
   const beadConvoyId =
@@ -338,6 +343,12 @@ export function BeadPanel({
             <Badge variant="outline" className="text-[10px]">
               {bead.type}
             </Badge>
+            {isBabysit && (
+              <span className="inline-flex items-center gap-1 rounded-md border border-cyan-500/30 bg-cyan-500/10 px-2 py-0.5 text-[10px] font-medium text-cyan-300">
+                <Eye className="size-2.5" />
+                Babysat external PR
+              </span>
+            )}
             <span
               className={`inline-flex items-center gap-0.5 text-[10px] font-medium ${PRIORITY_STYLES[bead.priority] ?? 'text-white/50'}`}
             >
@@ -526,6 +537,47 @@ export function BeadPanel({
         </div>
       )}
 
+      {/* Babysit metadata */}
+      {isBabysit && (
+        <div className="grid grid-cols-2 border-b border-white/[0.06]">
+          {typeof bead.metadata?.head_sha === 'string' && (
+            <MetaCell
+              icon={Hash}
+              label="Head SHA"
+              value={
+                prUrl && bead.metadata.head_sha.length >= 7 ? (
+                  <a
+                    href={`${prUrl.replace(/\/pull\/\d+.*$/, '/commit/').replace(/\/-\/merge_requests\/\d+.*$/, '/-/commit/')}${bead.metadata.head_sha}`}
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    className="font-mono text-xs text-[color:oklch(95%_0.15_108)] hover:underline"
+                  >
+                    {bead.metadata.head_sha.slice(0, 7)}
+                  </a>
+                ) : (
+                  <span className="font-mono text-xs">{bead.metadata.head_sha.slice(0, 7)}</span>
+                )
+              }
+              mono
+            />
+          )}
+          <MetaCell
+            icon={bead.metadata?.force_push_allowed === true ? Unlock : Lock}
+            label="Force-push"
+            value={bead.metadata?.force_push_allowed === true ? 'Allowed' : 'Blocked'}
+          />
+          {typeof bead.metadata?.babysit_started_at === 'string' && (
+            <MetaCell
+              icon={Clock}
+              label="Babysit started"
+              value={formatDistanceToNow(new Date(bead.metadata.babysit_started_at), {
+                addSuffix: true,
+              })}
+            />
+          )}
+        </div>
+      )}
+
       {/* Wasteland origin link — present when this bead was created in
           response to a wasteland event (e.g. a wanted-item claim). */}
       <WastelandOriginLink metadata={bead.metadata} pathname={pathname} />
@@ -677,7 +729,7 @@ function MetaCell({
 }: {
   icon: typeof Clock;
   label: string;
-  value: string;
+  value: ReactNode;
   mono?: boolean;
 }) {
   return (
@@ -692,143 +744,3 @@ function MetaCell({
     </div>
   );
 }
-
-// ── Related beads DAG ─────────────────────────────────────────────────
-
-type BeadLike = {
-  bead_id: string;
-  type: string;
-  status: string;
-  title: string;
-  parent_bead_id: string | null;
-  rig_id?: string | null;
-  metadata: Record<string, unknown>;
-};
-
-type RelatedBead = {
-  relation: string;
-  label: string;
-  icon: typeof Clock;
-  bead: BeadLike;
-};
-
-type ConvoyLike = {
-  id: string;
-  title: string;
-  feature_branch?: string | null;
-  beads: Array<{ bead_id: string; title: string; status: string; rig_id: string | null }>;
-  dependency_edges?: Array<{ bead_id: string; depends_on_bead_id: string }>;
-};
-
-/**
- * Compute the DAG neighborhood of a bead from the flat list and convoy data.
- * Includes: children, source/review links, blockers, and dependents from convoy DAG.
- */
-function buildRelatedBeads(
-  bead: BeadLike,
-  allBeads: BeadLike[],
-  convoys: ConvoyLike[]
-): RelatedBead[] {
-  const related: RelatedBead[] = [];
-
-  // Find which convoy this bead belongs to (if any) via metadata or convoy beads list
-  const convoyId = typeof bead.metadata?.convoy_id === 'string' ? bead.metadata.convoy_id : null;
-  const parentConvoy = convoys.find(
-    c => c.id === convoyId || c.beads.some(b => b.bead_id === bead.bead_id)
-  );
-
-  // Show convoy membership
-  if (parentConvoy) {
-    // Find blockers (beads that this bead depends on / is blocked by)
-    const edges = parentConvoy.dependency_edges ?? [];
-    const blockerIds = new Set(
-      edges.filter(e => e.bead_id === bead.bead_id).map(e => e.depends_on_bead_id)
-    );
-    for (const blockerId of blockerIds) {
-      const blockerBead = allBeads.find(b => b.bead_id === blockerId);
-      const convoyBead = parentConvoy.beads.find(b => b.bead_id === blockerId);
-      if (blockerBead) {
-        related.push({
-          relation: 'blocker',
-          label: 'Blocked by',
-          icon: ArrowUpRight,
-          bead: blockerBead,
-        });
-      } else if (convoyBead) {
-        // Bead is in convoy but not in the rig's bead list — use convoy data
-        related.push({
-          relation: 'blocker',
-          label: 'Blocked by',
-          icon: ArrowUpRight,
-          bead: {
-            bead_id: convoyBead.bead_id,
-            type: 'issue',
-            status: convoyBead.status,
-            title: convoyBead.title,
-            parent_bead_id: null,
-            rig_id: convoyBead.rig_id,
-            metadata: {},
-          },
-        });
-      }
-    }
-
-    // Find dependents (beads that depend on / are blocked by this bead)
-    const dependentIds = new Set(
-      edges.filter(e => e.depends_on_bead_id === bead.bead_id).map(e => e.bead_id)
-    );
-    for (const depId of dependentIds) {
-      const depBead = allBeads.find(b => b.bead_id === depId);
-      const convoyBead = parentConvoy.beads.find(b => b.bead_id === depId);
-      if (depBead) {
-        related.push({
-          relation: 'dependent',
-          label: 'Blocks',
-          icon: ArrowDownRight,
-          bead: depBead,
-        });
-      } else if (convoyBead) {
-        related.push({
-          relation: 'dependent',
-          label: 'Blocks',
-          icon: ArrowDownRight,
-          bead: {
-            bead_id: convoyBead.bead_id,
-            type: 'issue',
-            status: convoyBead.status,
-            title: convoyBead.title,
-            parent_bead_id: null,
-            rig_id: convoyBead.rig_id,
-            metadata: {},
-          },
-        });
-      }
-    }
-  }
-
-  // Child beads (beads whose parent_bead_id = this bead)
-  for (const b of allBeads) {
-    if (b.parent_bead_id === bead.bead_id) {
-      related.push({ relation: 'child', label: 'Child', icon: ArrowDownRight, bead: b });
-    }
-  }
-
-  // For merge_request beads: link back to the source bead
-  if (bead.type === 'merge_request' && typeof bead.metadata?.source_bead_id === 'string') {
-    const source = allBeads.find(b => b.bead_id === bead.metadata.source_bead_id);
-    if (source) {
-      related.push({ relation: 'source', label: 'Source Work', icon: CircleDot, bead: source });
-    }
-  }
-
-  // For non-MR beads: find any MR beads that track this bead
-  if (bead.type !== 'merge_request') {
-    for (const b of allBeads) {
-      if (b.type === 'merge_request' && b.metadata?.source_bead_id === bead.bead_id) {
-        related.push({ relation: 'review', label: 'Review', icon: GitPullRequest, bead: b });
-      }
-    }
-  }
-
-  return related;
-}
diff --git a/apps/web/src/components/gastown/drawer-panels/buildRelatedBeads.ts b/apps/web/src/components/gastown/drawer-panels/buildRelatedBeads.ts
new file mode 100644
index 0000000000..25bcd7f42e
--- /dev/null
+++ b/apps/web/src/components/gastown/drawer-panels/buildRelatedBeads.ts
@@ -0,0 +1,137 @@
+import {
+  ArrowDownRight,
+  ArrowUpRight,
+  GitPullRequest,
+  CircleDot,
+  type LucideIcon,
+} from 'lucide-react';
+
+export type BeadLike = {
+  bead_id: string;
+  type: string;
+  status: string;
+  title: string;
+  parent_bead_id: string | null;
+  rig_id?: string | null;
+  metadata: Record<string, unknown>;
+};
+
+export type RelatedBead = {
+  relation: string;
+  label: string;
+  icon: LucideIcon;
+  bead: BeadLike;
+};
+
+type ConvoyLike = {
+  id: string;
+  title: string;
+  feature_branch?: string | null;
+  beads: Array<{ bead_id: string; title: string; status: string; rig_id: string | null }>;
+  dependency_edges?: Array<{ bead_id: string; depends_on_bead_id: string }>;
+};
+
+/**
+ * Compute the DAG neighborhood of a bead from the flat list and convoy data.
+ * Includes: children, source/review links, blockers, and dependents from convoy DAG.
+ */
+export function buildRelatedBeads(
+  bead: BeadLike,
+  allBeads: BeadLike[],
+  convoys: ConvoyLike[]
+): RelatedBead[] {
+  const related: RelatedBead[] = [];
+
+  const convoyId = typeof bead.metadata?.convoy_id === 'string' ? bead.metadata.convoy_id : null;
+  const parentConvoy = convoys.find(
+    c => c.id === convoyId || c.beads.some(b => b.bead_id === bead.bead_id)
+  );
+
+  if (parentConvoy) {
+    const edges = parentConvoy.dependency_edges ?? [];
+    const blockerIds = new Set(
+      edges.filter(e => e.bead_id === bead.bead_id).map(e => e.depends_on_bead_id)
+    );
+    for (const blockerId of blockerIds) {
+      const blockerBead = allBeads.find(b => b.bead_id === blockerId);
+      const convoyBead = parentConvoy.beads.find(b => b.bead_id === blockerId);
+      if (blockerBead) {
+        related.push({
+          relation: 'blocker',
+          label: 'Blocked by',
+          icon: ArrowUpRight,
+          bead: blockerBead,
+        });
+      } else if (convoyBead) {
+        related.push({
+          relation: 'blocker',
+          label: 'Blocked by',
+          icon: ArrowUpRight,
+          bead: {
+            bead_id: convoyBead.bead_id,
+            type: 'issue',
+            status: convoyBead.status,
+            title: convoyBead.title,
+            parent_bead_id: null,
+            rig_id: convoyBead.rig_id,
+            metadata: {},
+          },
+        });
+      }
+    }
+
+    const dependentIds = new Set(
+      edges.filter(e => e.depends_on_bead_id === bead.bead_id).map(e => e.bead_id)
+    );
+    for (const depId of dependentIds) {
+      const depBead = allBeads.find(b => b.bead_id === depId);
+      const convoyBead = parentConvoy.beads.find(b => b.bead_id === depId);
+      if (depBead) {
+        related.push({
+          relation: 'dependent',
+          label: 'Blocks',
+          icon: ArrowDownRight,
+          bead: depBead,
+        });
+      } else if (convoyBead) {
+        related.push({
+          relation: 'dependent',
+          label: 'Blocks',
+          icon: ArrowDownRight,
+          bead: {
+            bead_id: convoyBead.bead_id,
+            type: 'issue',
+            status: convoyBead.status,
+            title: convoyBead.title,
+            parent_bead_id: null,
+            rig_id: convoyBead.rig_id,
+            metadata: {},
+          },
+        });
+      }
+    }
+  }
+
+  for (const b of allBeads) {
+    if (b.parent_bead_id === bead.bead_id) {
+      related.push({ relation: 'child', label: 'Child', icon: ArrowDownRight, bead: b });
+    }
+  }
+
+  if (bead.type === 'merge_request' && typeof bead.metadata?.source_bead_id === 'string') {
+    const source = allBeads.find(b => b.bead_id === bead.metadata.source_bead_id);
+    if (source) {
+      related.push({ relation: 'source', label: 'Source Work', icon: CircleDot, bead: source });
+    }
+  }
+
+  if (bead.type !== 'merge_request') {
+    for (const b of allBeads) {
+      if (b.type === 'merge_request' && b.metadata?.source_bead_id === bead.bead_id) {
+        related.push({ relation: 'review', label: 'Review', icon: GitPullRequest, bead: b });
+      }
+    }
+  }
+
+  return related;
+}
diff --git a/apps/web/src/components/gastown/eventDescription.ts b/apps/web/src/components/gastown/eventDescription.ts
new file mode 100644
index 0000000000..00437bd2ab
--- /dev/null
+++ b/apps/web/src/components/gastown/eventDescription.ts
@@ -0,0 +1,72 @@
+export function eventDescription(event: {
+  event_type: string;
+  old_value: string | null;
+  new_value: string | null;
+  metadata: Record<string, unknown>;
+  rig_name?: string;
+}): string {
+  const rigPrefix = event.rig_name ? `[${event.rig_name}] ` : '';
+  switch (event.event_type) {
+    case 'created': {
+      const title = event.metadata?.title;
+      return `${rigPrefix}Bead created: ${typeof title === 'string' ? title : (event.new_value ?? 'unknown')}`;
+    }
+    case 'hooked':
+      return `${rigPrefix}Agent hooked to bead`;
+    case 'unhooked':
+      return `${rigPrefix}Agent unhooked from bead`;
+    case 'status_changed': {
+      const desc = `${rigPrefix}Status: ${event.old_value ?? '?'} → ${event.new_value ?? '?'}`;
+      if (event.new_value === 'failed') {
+        const fr = event.metadata?.failure_reason;
+        if (typeof fr === 'object' && fr !== null && 'message' in fr) {
+          const msg = (fr as Record<string, unknown>).message;
+          if (typeof msg === 'string') return `${desc} — ${msg}`;
+        }
+      }
+      return desc;
+    }
+    case 'closed':
+      return `${rigPrefix}Bead closed`;
+    case 'escalated':
+      return `${rigPrefix}Escalation created`;
+    case 'review_submitted':
+      return `${rigPrefix}Submitted for review: ${event.new_value ?? ''}`;
+    case 'review_completed':
+      return `${rigPrefix}Review ${event.new_value ?? 'completed'}`;
+    case 'mail_sent':
+      return `${rigPrefix}Mail sent`;
+    case 'triage_resolved': {
+      const action = event.new_value ?? (event.metadata?.action as string | undefined) ?? 'unknown';
+      const notes = event.metadata?.resolution_notes as string | undefined;
+      const desc = `${rigPrefix}Triage: ${action}`;
+      return notes ? `${desc} — ${notes}` : desc;
+    }
+    case 'agent_status': {
+      const msg = event.new_value ?? (event.metadata?.message as string | undefined);
+      const agentName = event.metadata?.agent_name as string | undefined;
+      const rigName = event.metadata?.rig_name as string | undefined;
+      const body = msg ?? 'Agent status update';
+      const prefix = rigName ? `[${rigName}] ` : rigPrefix;
+      return agentName ? `${prefix}${agentName}: ${body}` : `${prefix}${body}`;
+    }
+    case 'babysit_started':
+      return `${rigPrefix}Babysit started — town is now monitoring this PR`;
+    case 'pr_feedback_detected': {
+      const source = event.metadata?.source as string | undefined;
+      return source
+        ? `${rigPrefix}PR feedback detected (${source})`
+        : `${rigPrefix}PR feedback detected`;
+    }
+    case 'pr_conflict_detected':
+      return `${rigPrefix}PR merge conflict detected`;
+    case 'pr_auto_merge':
+      return `${rigPrefix}PR auto-merge triggered`;
+    case 'pr_status_changed': {
+      const state = event.new_value ?? 'unknown';
+      return `${rigPrefix}PR status changed: ${state}`;
+    }
+    default:
+      return `${rigPrefix}${event.event_type}`;
+  }
+}
diff --git a/apps/web/src/lib/gastown/types/router.d.ts b/apps/web/src/lib/gastown/types/router.d.ts
index 530a9c6ff5..9349da8dd8 100644
--- a/apps/web/src/lib/gastown/types/router.d.ts
+++ b/apps/web/src/lib/gastown/types/router.d.ts
@@ -1616,6 +1616,35 @@ export declare const gastownRouter: import('@trpc/server').TRPCBuiltRouter<
       } | null;
       meta: object;
     }>;
+    babysitPr: import('@trpc/server').TRPCMutationProcedure<{
+      input: {
+        rigId: string;
+        prUrl: string;
+        title?: string | undefined;
+        body?: string | undefined;
+        forcePushAllowed?: boolean | undefined;
+      };
+      output: {
+        beadId: string;
+        warning?: string | undefined;
+      };
+      meta: object;
+    }>;
+    previewPr: import('@trpc/server').TRPCQueryProcedure<{
+      input: {
+        rigId: string;
+        prUrl: string;
+      };
+      output: {
+        state: string;
+        head_branch?: string | undefined;
+        base_branch?: string | undefined;
+        head_sha?: string | undefined;
+        title?: string | undefined;
+        repo_matches: boolean;
+      };
+      meta: object;
+    }>;
   }>
 >;
 export type GastownRouter = typeof gastownRouter;
@@ -3250,6 +3279,35 @@ export declare const wrappedGastownRouter: import('@trpc/server').TRPCBuiltRoute
           } | null;
           meta: object;
         }>;
+        babysitPr: import('@trpc/server').TRPCMutationProcedure<{
+          input: {
+            rigId: string;
+            prUrl: string;
+            title?: string | undefined;
+            body?: string | undefined;
+            forcePushAllowed?: boolean | undefined;
+          };
+          output: {
+            beadId: string;
+            warning?: string | undefined;
+          };
+          meta: object;
+        }>;
+        previewPr: import('@trpc/server').TRPCQueryProcedure<{
+          input: {
+            rigId: string;
+            prUrl: string;
+          };
+          output: {
+            state: string;
+            head_branch?: string | undefined;
+            base_branch?: string | undefined;
+            head_sha?: string | undefined;
+            title?: string | undefined;
+            repo_matches: boolean;
+          };
+          meta: object;
+        }>;
       }>
     >;
   }>
diff --git a/apps/web/src/lib/gastown/types/schemas.d.ts b/apps/web/src/lib/gastown/types/schemas.d.ts
index e1da4b1750..a5a560394f 100644
--- a/apps/web/src/lib/gastown/types/schemas.d.ts
+++ b/apps/web/src/lib/gastown/types/schemas.d.ts
@@ -1599,3 +1599,45 @@ export declare const RpcOrgTownOutput: z.ZodPipe<
     z.core.$strip
   >
 >;
+export declare const BabysitPrResultOutput: z.ZodObject<
+  {
+    beadId: z.ZodString;
+    warning: z.ZodOptional<z.ZodString>;
+  },
+  z.core.$strip
+>;
+export declare const PreviewPrResultOutput: z.ZodObject<
+  {
+    state: z.ZodString;
+    head_branch: z.ZodOptional<z.ZodString>;
+    base_branch: z.ZodOptional<z.ZodString>;
+    head_sha: z.ZodOptional<z.ZodString>;
+    title: z.ZodOptional<z.ZodString>;
+    repo_matches: z.ZodBoolean;
+  },
+  z.core.$strip
+>;
+export declare const RpcBabysitPrResultOutput: z.ZodPipe<
+  z.ZodAny,
+  z.ZodObject<
+    {
+      beadId: z.ZodString;
+      warning: z.ZodOptional<z.ZodString>;
+    },
+    z.core.$strip
+  >
+>;
+export declare const RpcPreviewPrResultOutput: z.ZodPipe<
+  z.ZodAny,
+  z.ZodObject<
+    {
+      state: z.ZodString;
+      head_branch: z.ZodOptional<z.ZodString>;
+      base_branch: z.ZodOptional<z.ZodString>;
+      head_sha: z.ZodOptional<z.ZodString>;
+      title: z.ZodOptional<z.ZodString>;
+      repo_matches: z.ZodBoolean;
+    },
+    z.core.$strip
+  >
+>;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 94de1a80ce..a5bb8fa091 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -2232,8 +2232,8 @@ importers:
         specifier: 7.2.52
         version: 7.2.52
       '@kilocode/sdk':
-        specifier: 7.2.14
-        version: 7.2.14
+        specifier: 7.3.1
+        version: 7.3.1
       hono:
         specifier: 4.12.25
         version: 4.12.25
@@ -4477,11 +4477,11 @@ packages:
 
   '@esbuild-kit/core-utils@3.3.2':
     resolution: {integrity: sha512-sPRAnw9CdSsRmEtnsl2WXWdyquogVpB3yZ3dgwJfe8zrOzTsV7cJvmwrKVa+0ma5BoiGJ+BoqkMvawbayKUsqQ==}
-    deprecated: 'Merged into tsx: https://tsx.hirok.io'
+    deprecated: 'Merged into tsx: https://tsx.is'
 
   '@esbuild-kit/esm-loader@2.6.5':
     resolution: {integrity: sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA==}
-    deprecated: 'Merged into tsx: https://tsx.hirok.io'
+    deprecated: 'Merged into tsx: https://tsx.is'
 
   '@esbuild/aix-ppc64@0.27.4':
     resolution: {integrity: sha512-cQPwL2mp2nSmHHJlCyoXgHGhbEPMrEEU5xhkcy3Hs/O7nGZqEpZ2sUtLaL9MORLtDfRvVl2/3PAuEkYZH0Ty8Q==}
@@ -5346,12 +5346,12 @@ packages:
       '@opentui/solid':
         optional: true
 
-  '@kilocode/sdk@7.2.14':
-    resolution: {integrity: sha512-Naz83lFrsbavuDp6UwxRuglOaSNvRBsZfcRNvb7RpWYAwbuJP0dBdhpXj6uO3ta5qxeQ2JzxKNC9Ffz+LCLLDg==}
-
   '@kilocode/sdk@7.2.52':
     resolution: {integrity: sha512-j8w6ewvo7dyu/qxjJAg0bcjHGUGGvIZ4F2f5tJnpMwLzPTAu26DJoO/08aoxf1BhfuZLzNS9tA2q+ZPdzPT8Jg==}
 
+  '@kilocode/sdk@7.3.1':
+    resolution: {integrity: sha512-UFsCx+Nman7J0jBTr1mZxt6IQkpxkxt3Lqa+gb7/1lSjo0psRgO61H9sUfgLDvAFeaJsQy7k7KMq1eigsbd4rQ==}
+
   '@kilocode/sdk@7.3.54':
     resolution: {integrity: sha512-A+g744DVuAHXSU3pu6BLe2AoxEh4fq7NdrYvlET3+waXSS0tG41Blr3ItCKSMLJH5M6C4rK2ZXi7plzkPNbdmA==}
 
@@ -21355,11 +21355,11 @@ snapshots:
       effect: 4.0.0-beta.57
       zod: 4.1.8
 
-  '@kilocode/sdk@7.2.14':
+  '@kilocode/sdk@7.2.52':
     dependencies:
       cross-spawn: 7.0.6
 
-  '@kilocode/sdk@7.2.52':
+  '@kilocode/sdk@7.3.1':
     dependencies:
       cross-spawn: 7.0.6
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 96c20040fe..1a75b937a8 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -42,6 +42,7 @@ catalog:
 
 minimumReleaseAge: 6842
 minimumReleaseAgeExclude:
+  - '@kilocode/*'
   - tsx
   - expo-dev-client
   - expo-dev-launcher
diff --git a/services/gastown/container/Dockerfile b/services/gastown/container/Dockerfile
index 5dbdc5057e..511d4a13c1 100644
--- a/services/gastown/container/Dockerfile
+++ b/services/gastown/container/Dockerfile
@@ -77,7 +77,7 @@ RUN apt-get update && \
 # Install both glibc and musl variants — the CLI's binary resolver may
 # pick either depending on the detected libc.
 # Also install pnpm — many projects use it as their package manager.
-RUN npm install -g @kilocode/cli@7.2.14 @kilocode/cli-linux-x64@7.2.14 @kilocode/cli-linux-x64-musl@7.2.14 @kilocode/plugin@7.2.14 pnpm && \
+RUN npm install -g @kilocode/cli@7.3.1 @kilocode/cli-linux-x64@7.3.1 @kilocode/cli-linux-x64-musl@7.3.1 @kilocode/plugin@7.3.1 pnpm && \
     ln -s "$(which kilo)" /usr/local/bin/opencode
 
 # Create non-root user for defense-in-depth
diff --git a/services/gastown/container/Dockerfile.dev b/services/gastown/container/Dockerfile.dev
index 8ed99f9724..e767c66a14 100644
--- a/services/gastown/container/Dockerfile.dev
+++ b/services/gastown/container/Dockerfile.dev
@@ -76,7 +76,7 @@ RUN apt-get update && \
 # pick either depending on the detected libc. bun:1-slim is Debian (glibc)
 # but the resolver sometimes misdetects; installing both is safe.
 # Also install pnpm — many projects use it as their package manager.
-RUN npm install -g @kilocode/cli@7.2.14 @kilocode/cli-linux-arm64@7.2.14 @kilocode/cli-linux-arm64-musl@7.2.14 @kilocode/plugin@7.2.14 pnpm && \
+RUN npm install -g @kilocode/cli@7.3.1 @kilocode/cli-linux-arm64@7.3.1 @kilocode/cli-linux-arm64-musl@7.3.1 @kilocode/plugin@7.3.1 pnpm && \
     ln -s "$(which kilo)" /usr/local/bin/opencode
 
 # Create non-root user for defense-in-depth
diff --git a/services/gastown/container/package.json b/services/gastown/container/package.json
index d413c6091d..b2508545d2 100644
--- a/services/gastown/container/package.json
+++ b/services/gastown/container/package.json
@@ -13,7 +13,7 @@
   },
   "dependencies": {
     "@kilocode/plugin": "7.2.52",
-    "@kilocode/sdk": "7.2.14",
+    "@kilocode/sdk": "7.3.1",
     "hono": "catalog:",
     "zod": "catalog:"
   },
diff --git a/services/gastown/container/plugin/client.test.ts b/services/gastown/container/plugin/client.test.ts
index 3c3c86ceb1..58c128d0e2 100644
--- a/services/gastown/container/plugin/client.test.ts
+++ b/services/gastown/container/plugin/client.test.ts
@@ -371,4 +371,50 @@ describe('MayorGastownClient', () => {
     const [url] = (globalThis.fetch as ReturnType<typeof vi.fn>).mock.calls[0] as [string];
     expect(url).toBe('https://gastown.example.com/api/mayor/town-1/tools/convoys/convoy-1');
   });
+
+  it('babysitPr() posts to babysit-pr endpoint', async () => {
+    const responseData = { beadId: 'babysit-bead-1' };
+    const fetchMock = mockFetch(responseData);
+    globalThis.fetch = fetchMock;
+
+    const result = await client.babysitPr({
+      rig_id: 'rig-1',
+      pr_url: 'https://github.com/owner/repo/pull/42',
+      title: 'Babysit: Fix auth',
+      force_push_allowed: false,
+    });
+
+    expect(result).toEqual(responseData);
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe('https://gastown.example.com/api/mayor/town-1/tools/babysit-pr');
+    expect(init.method).toBe('POST');
+    expect(JSON.parse(init.body as string)).toEqual({
+      rig_id: 'rig-1',
+      pr_url: 'https://github.com/owner/repo/pull/42',
+      title: 'Babysit: Fix auth',
+      body: undefined,
+      force_push_allowed: false,
+    });
+  });
+
+  it('babysitPr() omits optional fields when not provided', async () => {
+    const responseData = { beadId: 'babysit-bead-2', warning: 'PR from fork' };
+    const fetchMock = mockFetch(responseData);
+    globalThis.fetch = fetchMock;
+
+    const result = await client.babysitPr({
+      rig_id: 'rig-2',
+      pr_url: 'https://github.com/other/repo/pull/7',
+    });
+
+    expect(result).toEqual(responseData);
+    const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(JSON.parse(init.body as string)).toEqual({
+      rig_id: 'rig-2',
+      pr_url: 'https://github.com/other/repo/pull/7',
+      title: undefined,
+      body: undefined,
+      force_push_allowed: undefined,
+    });
+  });
 });
diff --git a/services/gastown/container/plugin/client.ts b/services/gastown/container/plugin/client.ts
index ecccf8b7c2..fc4c7cac21 100644
--- a/services/gastown/container/plugin/client.ts
+++ b/services/gastown/container/plugin/client.ts
@@ -1,6 +1,7 @@
 import type {
   Agent,
   ApiResponse,
+  BabysitPrResult,
   Bead,
   BeadPriority,
   BeadStatus,
@@ -380,6 +381,19 @@ export class MayorGastownClient {
     });
   }
 
+  async babysitPr(input: {
+    rig_id: string;
+    pr_url: string;
+    title?: string;
+    body?: string;
+    force_push_allowed?: boolean;
+  }): Promise<BabysitPrResult> {
+    return this.request<BabysitPrResult>(this.mayorPath('/babysit-pr'), {
+      method: 'POST',
+      body: JSON.stringify(input),
+    });
+  }
+
   async listRigs(): Promise<Rig[]> {
     return this.request<Rig[]>(this.mayorPath('/rigs'));
   }
diff --git a/services/gastown/container/plugin/mayor-tools.test.ts b/services/gastown/container/plugin/mayor-tools.test.ts
index 44a5bb1820..c5476c3552 100644
--- a/services/gastown/container/plugin/mayor-tools.test.ts
+++ b/services/gastown/container/plugin/mayor-tools.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import type { MayorGastownClient } from './client';
 import type {
   Agent,
+  BabysitPrResult,
   Bead,
   Convoy,
   ConvoyDetail,
@@ -87,6 +88,9 @@ function makeFakeMayorClient(overrides: Partial<MayorGastownClient> = {}): Mayor
       bead: FAKE_BEAD,
       agent: FAKE_AGENT,
     }),
+    babysitPr: vi.fn<() => Promise<BabysitPrResult>>().mockResolvedValue({
+      beadId: 'babysit-bead-1',
+    }),
     listRigs: vi.fn<() => Promise<Rig[]>>().mockResolvedValue([]),
     listBeads: vi.fn<() => Promise<Bead[]>>().mockResolvedValue([]),
     listAgents: vi.fn<() => Promise<Agent[]>>().mockResolvedValue([]),
@@ -588,4 +592,62 @@ describe('mayor tools', () => {
       });
     });
   });
+
+  describe('gt_babysit_pr', () => {
+    it('delegates to client.babysitPr and returns result summary', async () => {
+      const result = await tools.gt_babysit_pr.execute(
+        {
+          rig_id: 'rig-1',
+          pr_url: 'https://github.com/owner/repo/pull/42',
+        },
+        CTX
+      );
+      expect(result).toContain('Babysit started');
+      expect(result).toContain('https://github.com/owner/repo/pull/42');
+      expect(result).toContain('babysit-bead-1');
+      expect(client.babysitPr).toHaveBeenCalledWith({
+        rig_id: 'rig-1',
+        pr_url: 'https://github.com/owner/repo/pull/42',
+        title: undefined,
+        body: undefined,
+        force_push_allowed: undefined,
+      });
+    });
+
+    it('passes all optional fields to the client', async () => {
+      await tools.gt_babysit_pr.execute(
+        {
+          rig_id: 'rig-1',
+          pr_url: 'https://github.com/owner/repo/pull/99',
+          title: 'Babysit: Fix auth',
+          body: 'Please merge this PR',
+          force_push_allowed: true,
+        },
+        CTX
+      );
+      expect(client.babysitPr).toHaveBeenCalledWith({
+        rig_id: 'rig-1',
+        pr_url: 'https://github.com/owner/repo/pull/99',
+        title: 'Babysit: Fix auth',
+        body: 'Please merge this PR',
+        force_push_allowed: true,
+      });
+    });
+
+    it('includes warning in result when present', async () => {
+      client = makeFakeMayorClient({
+        babysitPr: vi.fn<() => Promise<BabysitPrResult>>().mockResolvedValue({
+          beadId: 'babysit-bead-2',
+          warning: 'PR is from a fork — limited permissions',
+        }),
+      });
+      tools = createMayorTools(client);
+
+      const result = await tools.gt_babysit_pr.execute(
+        { rig_id: 'rig-1', pr_url: 'https://github.com/owner/repo/pull/55' },
+        CTX
+      );
+      expect(result).toContain('Warning: PR is from a fork — limited permissions');
+    });
+  });
 });
diff --git a/services/gastown/container/plugin/mayor-tools.ts b/services/gastown/container/plugin/mayor-tools.ts
index 1f003f1d2a..60404bd0aa 100644
--- a/services/gastown/container/plugin/mayor-tools.ts
+++ b/services/gastown/container/plugin/mayor-tools.ts
@@ -80,6 +80,52 @@ export function createMayorTools(client: MayorGastownClient) {
       },
     }),
 
+    gt_babysit_pr: tool({
+      description:
+        'Adopt an existing pull request for the town to babysit. The town will poll the PR for review feedback, fix CI failures, resolve merge conflicts, and auto-merge when ready — exactly as it would for a PR the town created itself. Use this when the user wants the town to take over an existing PR (e.g. one they created manually, one created by another tool, or one from a third party they have rights to). For new feature work that should produce a PR, use gt_sling instead.',
+      args: {
+        rig_id: tool.schema.string().describe('The UUID of the rig the PR belongs to'),
+        pr_url: tool.schema
+          .string()
+          .describe(
+            'The full URL of the pull request to babysit (e.g. https://github.com/owner/repo/pull/123)'
+          ),
+        title: tool.schema
+          .string()
+          .describe(
+            'Optional title override for the babysit bead. Defaults to "Babysit: <PR title>".'
+          )
+          .optional(),
+        body: tool.schema
+          .string()
+          .describe('Optional body override for the babysit bead.')
+          .optional(),
+        force_push_allowed: tool.schema
+          .boolean()
+          .describe(
+            'Whether polecats may force-push to the PR branch when fixing conflicts or ' +
+              'addressing review comments. Default false. Only set true if the user owns the ' +
+              'branch or the PR author has explicitly consented. When false, polecats use ' +
+              'merge commits and regular pushes only.'
+          )
+          .optional(),
+      },
+      async execute(args) {
+        const result = await client.babysitPr({
+          rig_id: args.rig_id,
+          pr_url: args.pr_url,
+          title: args.title,
+          body: args.body,
+          force_push_allowed: args.force_push_allowed,
+        });
+        const lines = [`Babysit started for PR: ${args.pr_url}`, `Bead: ${result.beadId}`];
+        if (result.warning) {
+          lines.push(`Warning: ${result.warning}`);
+        }
+        return lines.join('\n');
+      },
+    }),
+
     gt_list_rigs: tool({
       description:
         'List all rigs (repositories) in your town. ' +
diff --git a/services/gastown/container/plugin/types.ts b/services/gastown/container/plugin/types.ts
index 531d8cc116..655ffe2a5f 100644
--- a/services/gastown/container/plugin/types.ts
+++ b/services/gastown/container/plugin/types.ts
@@ -63,6 +63,33 @@ export type PrimeContext = {
   hooked_bead: Bead | null;
   undelivered_mail: Mail[];
   open_beads: Bead[];
+  /** Present when the hooked bead is a rework request (gt:rework label). */
+  rework_context: {
+    feedback: string;
+    branch: string | null;
+    target_branch: string | null;
+    files: string[];
+    original_bead_title: string | null;
+    mr_bead_id: string | null;
+  } | null;
+  /** Present when the hooked bead is a PR fixup (gt:pr-fixup label). */
+  pr_fixup_context: {
+    pr_url: string | null;
+    branch: string | null;
+    target_branch: string | null;
+    /** Whether force-push is allowed on this PR branch. Absent = true (backwards compat). */
+    force_push_allowed: boolean;
+  } | null;
+  /** Present when the hooked bead is a PR conflict resolution (gt:pr-conflict label). */
+  pr_conflict_context: {
+    pr_url: string | null;
+    branch: string | null;
+    target_branch: string | null;
+    /** When true, the bead also has pending review feedback to address after resolving conflicts. */
+    has_feedback: boolean;
+    /** Whether force-push is allowed on this PR branch. Absent = true (backwards compat). */
+    force_push_allowed: boolean;
+  } | null;
 };
 
 // API response envelope
@@ -81,6 +108,13 @@ export type Rig = {
   updated_at: string;
 };
 
+// Result of POST /babysit-pr — the babysit adoption creates a bead and
+// optionally returns a warning (e.g. PR already merged, but adoption proceeds).
+export type BabysitPrResult = {
+  beadId: string;
+  warning?: string;
+};
+
 // Sling result (bead + assigned agent)
 export type SlingResult = {
   bead: Bead;
diff --git a/services/gastown/container/src/agent-runner.test.ts b/services/gastown/container/src/agent-runner.test.ts
index da33166d16..7123c1d7e2 100644
--- a/services/gastown/container/src/agent-runner.test.ts
+++ b/services/gastown/container/src/agent-runner.test.ts
@@ -18,7 +18,7 @@ vi.mock('./logger', () => ({
   log: { info: vi.fn() },
 }));
 
-import { buildAgentEnv, buildKiloConfigContent } from './agent-runner';
+import { buildAgentEnv, buildKiloAuthEnv, buildKiloConfigContent } from './agent-runner';
 import type { StartAgentRequest } from './types';
 
 function baseRequest(overrides: Partial<StartAgentRequest> = {}): StartAgentRequest {
@@ -117,3 +117,44 @@ describe('buildKiloConfigContent', () => {
     expect(parsed.provider.kilo.options.kilocodeOrganizationId).toBeUndefined();
   });
 });
+
+describe('buildKiloAuthEnv', () => {
+  it('sets KILO_PLATFORM to gastown', () => {
+    const env = buildKiloAuthEnv(undefined, undefined);
+    expect(env.KILO_PLATFORM).toBe('gastown');
+  });
+
+  it('sets KILO_AUTH_CONTENT when kilocodeToken is provided', () => {
+    const env = buildKiloAuthEnv('tok-abc', undefined);
+    expect(env.KILO_AUTH_CONTENT).toBe(JSON.stringify({ kilo: { type: 'api', key: 'tok-abc' } }));
+  });
+
+  it('omits KILO_AUTH_CONTENT when kilocodeToken is absent', () => {
+    const env = buildKiloAuthEnv(undefined, undefined);
+    expect(env.KILO_AUTH_CONTENT).toBeUndefined();
+  });
+
+  it('sets KILO_ORG_ID when organizationId is provided', () => {
+    const env = buildKiloAuthEnv('tok', 'org-123');
+    expect(env.KILO_ORG_ID).toBe('org-123');
+  });
+
+  it('omits KILO_ORG_ID when organizationId is null', () => {
+    const env = buildKiloAuthEnv('tok', null);
+    expect(env.KILO_ORG_ID).toBeUndefined();
+  });
+
+  it('omits KILO_ORG_ID when organizationId is undefined', () => {
+    const env = buildKiloAuthEnv('tok', undefined);
+    expect(env.KILO_ORG_ID).toBeUndefined();
+  });
+
+  it('sets all three env vars when both inputs are provided', () => {
+    const env = buildKiloAuthEnv('tok-full', 'org-full');
+    expect(env).toEqual({
+      KILO_PLATFORM: 'gastown',
+      KILO_AUTH_CONTENT: JSON.stringify({ kilo: { type: 'api', key: 'tok-full' } }),
+      KILO_ORG_ID: 'org-full',
+    });
+  });
+});
diff --git a/services/gastown/container/src/agent-runner.ts b/services/gastown/container/src/agent-runner.ts
index 30ac6330ca..17d226f1a8 100644
--- a/services/gastown/container/src/agent-runner.ts
+++ b/services/gastown/container/src/agent-runner.ts
@@ -85,6 +85,22 @@ export function buildKiloConfigContent(
   } satisfies Config);
 }
 
+export function buildKiloAuthEnv(
+  kilocodeToken: string | undefined,
+  organizationId: string | undefined | null
+): Record<string, string> {
+  const env: Record<string, string> = {
+    KILO_PLATFORM: 'gastown',
+  };
+  if (kilocodeToken) {
+    env.KILO_AUTH_CONTENT = JSON.stringify({ kilo: { type: 'api', key: kilocodeToken } });
+  }
+  if (organizationId) {
+    env.KILO_ORG_ID = organizationId;
+  }
+  return env;
+}
+
 export function buildAgentEnv(request: StartAgentRequest): Record<string, string> {
   // Custom git identity: when GASTOWN_GIT_AUTHOR_NAME is set, the user becomes
   // the primary author and the AI agent name is used for co-authorship trailers.
@@ -173,30 +189,11 @@ GASTOWN_TOWN_ID="${env.GASTOWN_TOWN_ID}"`);
     console.log(
       `[buildAgentEnv] KILO_CONFIG_CONTENT set (model=${request.model}, smallModel=${request.smallModel ?? '(default)'})`
     );
-
-    // Set KILO_AUTH_CONTENT so the kilo CLI's session-ingest path can
-    // authenticate. The CLI's Auth.all() reads this env var before
-    // falling back to the auth.json file. Without it, session deltas
-    // get "session bootstrap skipped: no client" and never reach
-    // cli_sessions_v2.
-    env.KILO_AUTH_CONTENT = JSON.stringify({
-      kilo: { type: 'api', key: kilocodeToken },
-    });
   } else {
     console.warn('[buildAgentEnv] No KILOCODE_TOKEN available — KILO_CONFIG_CONTENT not set');
   }
 
-  // Set KILO_PLATFORM so session-ingest writes created_on_platform =
-  // 'gastown'. The /cloud/sessions page has a "Gastown" filter that
-  // matches this value.
-  env.KILO_PLATFORM = 'gastown';
-
-  // Set KILO_ORG_ID so session-ingest populates organization_id for
-  // org-scoped filtering. Falls back to the auth file's accountId
-  // inside the CLI if not set.
-  if (request.organizationId) {
-    env.KILO_ORG_ID = request.organizationId;
-  }
+  Object.assign(env, buildKiloAuthEnv(kilocodeToken, request.organizationId));
 
   // Authenticate the gh CLI via GH_TOKEN. Prefer the user's GitHub CLI PAT
   // (which makes PRs/issues appear under their identity) over the integration
@@ -518,58 +515,21 @@ export async function runAgent(originalRequest: StartAgentRequest): Promise<Mana
     workdir = await createLightweightWorkspace('triage', request.rigId);
   } else if (request.role === 'mayor') {
     // Mayor doesn't need a repo clone — just a git-initialized directory
+    const workspaceStart = Date.now();
     workdir = await createMayorWorkspace(request.rigId);
+    log.info('mayor.workspace_created_ms', {
+      agentId: request.agentId,
+      townId: request.townId,
+      durationMs: Date.now() - workspaceStart,
+    });
 
-    // On fresh containers the browse worktrees won't exist yet. Set them
-    // up for all known rigs before writing AGENTS.md so the mayor (and its
-    // sub-agents) can immediately browse codebases.
+    // On fresh containers the browse worktrees won't exist yet. Refresh
+    // them in the background so mayor readiness does not wait on clone/fetch
+    // work across every rig.
     if (request.rigs?.length) {
-      // Resolve credentials per-rig since each may use a different
-      // GitHub App installation (platformIntegrationId).
-      const baseEnvVars = request.envVars ?? {};
-      const rigSetupResults = await Promise.allSettled(
-        request.rigs.map(async rig => {
-          const envVars = await resolveGitCredentials({
-            envVars: baseEnvVars,
-            platformIntegrationId: rig.platformIntegrationId,
-          });
-          const hasGitToken = !!(envVars.GIT_TOKEN || envVars.GITHUB_TOKEN || envVars.GITLAB_TOKEN);
-          console.log(
-            `[runAgent] setting up browse worktree: rig=${rig.rigId} gitUrl=${rig.gitUrl} hasGitToken=${hasGitToken}`
-          );
-          await setupRigBrowseWorktree({
-            rigId: rig.rigId,
-            gitUrl: rig.gitUrl,
-            defaultBranch: rig.defaultBranch,
-            envVars,
-          });
-          return rig.rigId;
-        })
-      );
-
-      const failures: Array<{ rigId: string; error: unknown }> = [];
-      for (let i = 0; i < rigSetupResults.length; i++) {
-        const r = rigSetupResults[i];
-        if (r.status === 'rejected') {
-          const reason: unknown = r.reason;
-          failures.push({ rigId: request.rigs[i].rigId, error: reason });
-        }
-      }
-
-      if (failures.length > 0) {
-        for (const f of failures) {
-          const msg = f.error instanceof Error ? f.error.message : String(f.error);
-          const stack = f.error instanceof Error ? f.error.stack : undefined;
-          console.error(
-            `[runAgent] browse worktree setup FAILED for rig=${f.rigId}: ${msg}`,
-            stack ? `\n${stack}` : ''
-          );
-        }
-        console.error(
-          `[runAgent] mayor rig setup: ${failures.length}/${request.rigs.length} rigs failed. ` +
-            `Mayor will start but may not be able to browse these codebases.`
-        );
-      }
+      void setupMayorBrowseWorktrees(request).catch(err => {
+        console.error('[runAgent] background mayor browse worktree setup failed:', err);
+      });
     }
 
     // Write the system prompt to AGENTS.md so the mayor AND its built-in
@@ -577,7 +537,13 @@ export async function runAgent(originalRequest: StartAgentRequest): Promise<Mana
     // The system prompt is NOT passed via the session.prompt API — AGENTS.md
     // is the sole source of truth for the mayor's instructions.
     if (request.systemPrompt) {
+      const writeAgentsStart = Date.now();
       await writeMayorSystemPromptToAgentsMd(workdir, request.systemPrompt);
+      log.info('mayor.write_agents_md_ms', {
+        agentId: request.agentId,
+        townId: request.townId,
+        durationMs: Date.now() - writeAgentsStart,
+      });
     }
   } else {
     // Resolve git credentials if missing. When the town config doesn't have
@@ -632,3 +598,61 @@ export async function runAgent(originalRequest: StartAgentRequest): Promise<Mana
 
   return startAgent(startRequest, workdir, env);
 }
+
+async function setupMayorBrowseWorktrees(request: StartAgentRequest): Promise<void> {
+  if (!request.rigs?.length) return;
+
+  const setupStart = Date.now();
+  const baseEnvVars = request.envVars ?? {};
+  const rigSetupResults = await Promise.allSettled(
+    request.rigs.map(async rig => {
+      const envVars = await resolveGitCredentials({
+        envVars: baseEnvVars,
+        platformIntegrationId: rig.platformIntegrationId,
+      });
+      const hasGitToken = !!(envVars.GIT_TOKEN || envVars.GITHUB_TOKEN || envVars.GITLAB_TOKEN);
+      console.log(
+        `[runAgent] setting up browse worktree: rig=${rig.rigId} gitUrl=${rig.gitUrl} hasGitToken=${hasGitToken}`
+      );
+      await setupRigBrowseWorktree({
+        rigId: rig.rigId,
+        gitUrl: rig.gitUrl,
+        defaultBranch: rig.defaultBranch,
+        envVars,
+      });
+      return rig.rigId;
+    })
+  );
+
+  const failures: Array<{ rigId: string; error: unknown }> = [];
+  for (let i = 0; i < rigSetupResults.length; i++) {
+    const result = rigSetupResults[i];
+    if (result.status === 'rejected') {
+      failures.push({ rigId: request.rigs[i].rigId, error: result.reason });
+    }
+  }
+
+  if (failures.length > 0) {
+    for (const failure of failures) {
+      const msg = failure.error instanceof Error ? failure.error.message : String(failure.error);
+      const stack = failure.error instanceof Error ? failure.error.stack : undefined;
+      console.error(
+        `[runAgent] browse worktree setup FAILED for rig=${failure.rigId}: ${msg}`,
+        stack ? `\n${stack}` : ''
+      );
+    }
+    console.error(
+      `[runAgent] mayor rig setup: ${failures.length}/${request.rigs.length} rigs failed. ` +
+        `Mayor will start but may not be able to browse these codebases.`
+    );
+  }
+
+  const setupDurationMs = Date.now() - setupStart;
+  log.info('mayor.browse_worktree_setup_ms', {
+    agentId: request.agentId,
+    townId: request.townId,
+    durationMs: setupDurationMs,
+    rigCount: request.rigs.length,
+    failureCount: failures.length,
+  });
+}
diff --git a/services/gastown/container/src/control-server.ts b/services/gastown/container/src/control-server.ts
index 749ebdd7b8..f5d116017b 100644
--- a/services/gastown/container/src/control-server.ts
+++ b/services/gastown/container/src/control-server.ts
@@ -42,6 +42,11 @@ import { classifyStartupError } from './startup-error';
 const MAX_TICKETS = 1000;
 const streamTickets = new Map<string, { agentId: string; expiresAt: number }>();
 
+const RefreshTokenRequest = z.object({
+  token: z.string().min(1),
+  townId: z.string().optional(),
+});
+
 // Minimal Zod schema for the town config delivered via X-Town-Config header.
 // Uses z.record() so any string-keyed object is accepted and future keys are preserved.
 const TownConfigHeader = z.record(z.string(), z.unknown());
@@ -96,6 +101,8 @@ function syncTownConfigToProcessEnv(): void {
   if (!cfg) return;
 
   const CONFIG_ENV_MAP: Array<[string, string]> = [
+    ['town_id', 'GASTOWN_TOWN_ID'],
+    ['gastown_api_url', 'GASTOWN_API_URL'],
     ['github_cli_pat', 'GITHUB_CLI_PAT'],
     ['git_author_name', 'GASTOWN_GIT_AUTHOR_NAME'],
     ['git_author_email', 'GASTOWN_GIT_AUTHOR_EMAIL'],
@@ -162,6 +169,12 @@ function syncTownConfigToProcessEnv(): void {
     process.env[key] = String(value);
   }
   lastAppliedEnvVarKeys = newCustomKeys;
+
+  const apiUrl = process.env.GASTOWN_API_URL;
+  const authToken = process.env.GASTOWN_CONTAINER_TOKEN ?? process.env.GASTOWN_SESSION_TOKEN;
+  if (apiUrl && authToken) {
+    startHeartbeat(apiUrl, authToken);
+  }
 }
 
 export const app = new Hono();
@@ -177,6 +190,7 @@ app.use('*', async (c, next) => {
       const result = TownConfigHeader.safeParse(raw);
       if (result.success) {
         lastKnownTownConfig = result.data;
+        syncTownConfigToProcessEnv();
         const hasToken =
           typeof result.data.kilocode_token === 'string' && result.data.kilocode_token.length > 0;
         console.log(
@@ -261,11 +275,12 @@ app.post('/dashboard-context', async c => {
 // server — matching the model hot-swap path.
 app.post('/refresh-token', async c => {
   const body: unknown = await c.req.json().catch(() => null);
-  if (!body || typeof body !== 'object' || !('token' in body) || typeof body.token !== 'string') {
-    return c.json({ error: 'Missing or invalid token field' }, 400);
+  const parsed = RefreshTokenRequest.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: 'Invalid request body', issues: parsed.error.issues }, 400);
   }
   // Capture the new token into a local so it survives the await below.
-  const newToken = body.token;
+  const newToken = parsed.data.token;
 
   // Wait for boot hydration to release the global sdkServerLock before
   // we mutate process.env or serialise N agent restarts through it.
@@ -277,6 +292,9 @@ app.post('/refresh-token', async c => {
 
   // Now safe to assign: hydration is done, no concurrent env readers.
   process.env.GASTOWN_CONTAINER_TOKEN = newToken;
+  if (parsed.data.townId) {
+    process.env.GASTOWN_TOWN_ID = parsed.data.townId;
+  }
 
   const activeAgents = listAgents().filter(a => a.status === 'running' || a.status === 'starting');
   log.info('refresh_token.received', {
@@ -304,9 +322,8 @@ app.post('/refresh-token', async c => {
 
 // POST /sync-config
 // Push config-derived env vars from X-Town-Config into process.env on
-// the running container. Called by TownDO.syncConfigToContainer() after
-// persisting env vars to DO storage, so the live process picks up
-// changes (e.g. refreshed KILOCODE_TOKEN) without a container restart.
+// the running container, so the live process picks up changes (e.g.
+// refreshed KILOCODE_TOKEN) without a container restart.
 app.post('/sync-config', async c => {
   syncTownConfigToProcessEnv();
   return c.json({ synced: true });
@@ -339,6 +356,14 @@ app.post('/agents/start', async c => {
   // config rebuilds (e.g. model hot-swap). The env var is the primary
   // source of truth; KILO_CONFIG_CONTENT extraction is the fallback.
   process.env.GASTOWN_ORGANIZATION_ID = parsed.data.organizationId ?? '';
+  process.env.GASTOWN_TOWN_ID = parsed.data.townId;
+  if (parsed.data.envVars?.GASTOWN_CONTAINER_TOKEN) {
+    process.env.GASTOWN_CONTAINER_TOKEN = parsed.data.envVars.GASTOWN_CONTAINER_TOKEN;
+  }
+  const heartbeatToken = process.env.GASTOWN_CONTAINER_TOKEN ?? process.env.GASTOWN_SESSION_TOKEN;
+  if (process.env.GASTOWN_API_URL && heartbeatToken) {
+    startHeartbeat(process.env.GASTOWN_API_URL, heartbeatToken);
+  }
 
   console.log(
     `[control-server] /agents/start: role=${parsed.data.role} name=${parsed.data.name} rigId=${parsed.data.rigId} agentId=${parsed.data.agentId}`
@@ -680,10 +705,14 @@ app.post('/git/merge', async c => {
 // Called by the process-manager when the agent goes idle.
 app.get('/agents/:agentId/pending-nudges', async c => {
   const { agentId } = c.req.param();
-  const apiUrl = process.env.GASTOWN_API_URL;
-  const token = process.env.GASTOWN_CONTAINER_TOKEN ?? process.env.GASTOWN_SESSION_TOKEN;
-  const townId = process.env.GASTOWN_TOWN_ID;
-  const rigId = process.env.GASTOWN_RIG_ID;
+  const agent = getAgentStatus(agentId);
+  const apiUrl = agent?.gastownApiUrl ?? process.env.GASTOWN_API_URL;
+  const token =
+    process.env.GASTOWN_CONTAINER_TOKEN ??
+    agent?.gastownContainerToken ??
+    agent?.gastownSessionToken;
+  const townId = agent?.townId ?? process.env.GASTOWN_TOWN_ID;
+  const rigId = agent?.rigId;
 
   if (!apiUrl || !token || !townId || !rigId) {
     return c.json({ error: 'Missing gastown configuration' }, 503);
@@ -713,10 +742,14 @@ app.get('/agents/:agentId/pending-nudges', async c => {
 // Body: { nudge_id: string }
 app.post('/agents/:agentId/nudge-delivered', async c => {
   const { agentId } = c.req.param();
-  const apiUrl = process.env.GASTOWN_API_URL;
-  const token = process.env.GASTOWN_CONTAINER_TOKEN ?? process.env.GASTOWN_SESSION_TOKEN;
-  const townId = process.env.GASTOWN_TOWN_ID;
-  const rigId = process.env.GASTOWN_RIG_ID;
+  const agent = getAgentStatus(agentId);
+  const apiUrl = agent?.gastownApiUrl ?? process.env.GASTOWN_API_URL;
+  const token =
+    process.env.GASTOWN_CONTAINER_TOKEN ??
+    agent?.gastownContainerToken ??
+    agent?.gastownSessionToken;
+  const townId = agent?.townId ?? process.env.GASTOWN_TOWN_ID;
+  const rigId = agent?.rigId;
 
   if (!apiUrl || !token || !townId || !rigId) {
     return c.json({ error: 'Missing gastown configuration' }, 503);
diff --git a/services/gastown/container/src/git-manager.ts b/services/gastown/container/src/git-manager.ts
index db1e730ace..166cda5f50 100644
--- a/services/gastown/container/src/git-manager.ts
+++ b/services/gastown/container/src/git-manager.ts
@@ -451,6 +451,12 @@ async function pathExists(p: string): Promise<boolean> {
   }
 }
 
+async function localBranchExists(repo: string, branch: string): Promise<boolean> {
+  return exec('git', ['show-ref', '--verify', '--quiet', `refs/heads/${branch}`], repo)
+    .then(() => true)
+    .catch(() => false);
+}
+
 async function repoDir(rigId: string): Promise<string> {
   validatePathSegment(rigId, 'rigId');
   const dir = resolve(WORKSPACE_ROOT, rigId, 'repo');
@@ -582,6 +588,7 @@ export function createWorktree(options: WorktreeOptions): Promise<string> {
 }
 
 async function createWorktreeInner(options: WorktreeOptions): Promise<string> {
+  validateBranchName(options.branch, 'branch');
   const repo = await repoDir(options.rigId);
   const dir = await worktreeDir(options.rigId, options.branch);
 
@@ -611,29 +618,32 @@ async function createWorktreeInner(options: WorktreeOptions): Promise<string> {
     );
   }
 
-  // When a startPoint is provided (e.g. a convoy feature branch), create
-  // the new branch from that ref so the agent begins with the latest
-  // merged work from upstream. Without a startPoint, try to track the
-  // remote branch or fall back to the repo's current HEAD.
-  const startPoint = options.startPoint;
-  try {
-    if (startPoint) {
-      await exec('git', ['branch', options.branch, startPoint], repo);
-    } else {
-      await exec('git', ['branch', '--track', options.branch, `origin/${options.branch}`], repo);
-    }
-  } catch {
-    // Fall back to origin/<defaultBranch> so we always branch from the
-    // latest remote tip rather than the repo's local HEAD (which may be
-    // stale in a --no-checkout bare clone).
-    const fallback = options.defaultBranch ? `origin/${options.defaultBranch}` : undefined;
-    if (fallback) {
-      await exec('git', ['branch', options.branch, fallback], repo);
-    } else {
-      await exec('git', ['branch', options.branch], repo);
+  if (!(await localBranchExists(repo, options.branch))) {
+    // When a startPoint is provided (e.g. a convoy feature branch), create
+    // the new branch from that ref so the agent begins with the latest
+    // merged work from upstream. Without a startPoint, try to track the
+    // remote branch or fall back to the repo's current HEAD.
+    const startPoint = options.startPoint;
+    try {
+      if (startPoint) {
+        await exec('git', ['branch', options.branch, startPoint], repo);
+      } else {
+        await exec('git', ['branch', '--track', options.branch, `origin/${options.branch}`], repo);
+      }
+    } catch {
+      // Fall back to origin/<defaultBranch> so we always branch from the
+      // latest remote tip rather than the repo's local HEAD (which may be
+      // stale in a --no-checkout bare clone).
+      const fallback = options.defaultBranch ? `origin/${options.defaultBranch}` : undefined;
+      if (fallback) {
+        await exec('git', ['branch', options.branch, fallback], repo);
+      } else {
+        await exec('git', ['branch', options.branch], repo);
+      }
     }
   }
 
+  await exec('git', ['worktree', 'prune'], repo).catch(() => {});
   await exec('git', ['worktree', 'add', dir, options.branch], repo);
   console.log(`Created worktree for branch ${options.branch} at ${dir}`);
   return dir;
diff --git a/services/gastown/container/src/heartbeat.ts b/services/gastown/container/src/heartbeat.ts
index 2d6e328599..fa9ff4c330 100644
--- a/services/gastown/container/src/heartbeat.ts
+++ b/services/gastown/container/src/heartbeat.ts
@@ -23,6 +23,10 @@ const CONTAINER_INSTANCE_ID = crypto.randomUUID();
  * which forwards them to the Rig DO to update `last_activity_at`.
  */
 export function startHeartbeat(apiUrl: string, token: string): void {
+  if (heartbeatTimer && gastownApiUrl === apiUrl && sessionToken === token) {
+    return;
+  }
+
   gastownApiUrl = apiUrl;
   sessionToken = token;
 
diff --git a/services/gastown/container/src/main.ts b/services/gastown/container/src/main.ts
index 4abff0666e..07b0ecb230 100644
--- a/services/gastown/container/src/main.ts
+++ b/services/gastown/container/src/main.ts
@@ -2,16 +2,17 @@ import { startControlServer } from './control-server';
 import { log } from './logger';
 import { activeAgentCount, bootHydration, getUptime, listAgents } from './process-manager';
 
-// Container-scoped identifiers for crash/diagnostic logs. The container is
-// pinned to a single town for its lifetime (see GASTOWN_TOWN_ID injection in
-// the deployer), so reading these once at module init is safe and lets us
-// emit them even when no agents are registered yet.
-const TOWN_ID = process.env.GASTOWN_TOWN_ID ?? null;
+// Container-scoped identifier for crash/diagnostic logs. It can arrive at
+// boot via container start options or shortly after via the first control
+// request, so read it when logging instead of capturing module-init state.
+function townIdForLogs(): string | null {
+  return process.env.GASTOWN_TOWN_ID ?? null;
+}
 
 log.info('container.cold_start', {
   uptime: getUptime(),
   ts: new Date().toISOString(),
-  townId: TOWN_ID,
+  townId: townIdForLogs(),
 });
 
 // Bun (like Node) will ignore unhandled promise rejections unless a handler
@@ -30,7 +31,7 @@ process.on('unhandledRejection', reason => {
       : { message: String(reason) };
   log.error('container.unhandled_rejection', {
     ...err,
-    townId: TOWN_ID,
+    townId: townIdForLogs(),
     uptimeMs: getUptime(),
     activeAgents: activeAgentCount(),
   });
@@ -41,7 +42,7 @@ process.on('uncaughtException', err => {
     message: err.message,
     stack: err.stack,
     name: err.name,
-    townId: TOWN_ID,
+    townId: townIdForLogs(),
     uptimeMs: getUptime(),
     activeAgents: activeAgentCount(),
   });
@@ -68,7 +69,7 @@ setInterval(() => {
       heapUsedMB: Math.round(mem.heapUsed / 1024 / 1024),
       heapTotalMB: Math.round(mem.heapTotal / 1024 / 1024),
       externalMB: Math.round(mem.external / 1024 / 1024),
-      townId: TOWN_ID,
+      townId: townIdForLogs(),
       uptimeMs: getUptime(),
       agents: listAgents().length,
       activeAgents: activeAgentCount(),
@@ -93,7 +94,7 @@ void (async () => {
     log.error('container.boot_hydration_failed', {
       message: err instanceof Error ? err.message : String(err),
       stack: err instanceof Error ? err.stack : undefined,
-      townId: TOWN_ID,
+      townId: townIdForLogs(),
     });
   }
 })();
diff --git a/services/gastown/container/src/process-manager.test.ts b/services/gastown/container/src/process-manager.test.ts
index 1afd68112c..bd65ed23a7 100644
--- a/services/gastown/container/src/process-manager.test.ts
+++ b/services/gastown/container/src/process-manager.test.ts
@@ -14,6 +14,16 @@ vi.mock('./agent-runner', () => ({
     (kilocodeToken: string, model: string, smallModel: string, organizationId?: string) =>
       JSON.stringify({ kilocodeToken, model, smallModel, organizationId })
   ),
+  buildKiloAuthEnv: vi.fn((kilocodeToken?: string, organizationId?: string | null) => {
+    const authEnv: Record<string, string> = { KILO_PLATFORM: 'gastown' };
+    if (kilocodeToken) {
+      authEnv.KILO_AUTH_CONTENT = JSON.stringify({ kilo: { type: 'api', key: kilocodeToken } });
+    }
+    if (organizationId) {
+      authEnv.KILO_ORG_ID = organizationId;
+    }
+    return authEnv;
+  }),
   resolveGitCredentials: vi.fn(),
   writeMayorSystemPromptToAgentsMd: vi.fn(),
   ensureMayorWorkspaceForTown: vi.fn(async (_townId: string) => TEST_WORKSPACE),
@@ -214,10 +224,12 @@ describe('awaitHydration', () => {
       apiUrl: process.env.GASTOWN_API_URL,
       townId: process.env.GASTOWN_TOWN_ID,
       token: process.env.GASTOWN_CONTAINER_TOKEN,
+      kiloOrgId: process.env.KILO_ORG_ID,
     };
     process.env.GASTOWN_API_URL = 'http://test.invalid';
     process.env.GASTOWN_TOWN_ID = 'town-prewarm';
     process.env.GASTOWN_CONTAINER_TOKEN = 'tok-prewarm';
+    delete process.env.KILO_ORG_ID;
 
     let capturedEnv: Record<string, string | undefined> | null = null;
     createKilo.mockImplementationOnce(() => {
@@ -229,6 +241,9 @@ describe('awaitHydration', () => {
         GASTOWN_API_URL: process.env.GASTOWN_API_URL,
         GASTOWN_CONTAINER_TOKEN: process.env.GASTOWN_CONTAINER_TOKEN,
         KILO_CONFIG_CONTENT: process.env.KILO_CONFIG_CONTENT,
+        KILO_AUTH_CONTENT: process.env.KILO_AUTH_CONTENT,
+        KILO_PLATFORM: process.env.KILO_PLATFORM,
+        KILO_ORG_ID: process.env.KILO_ORG_ID,
       };
       return Promise.resolve({
         client: {} as unknown,
@@ -270,6 +285,9 @@ describe('awaitHydration', () => {
         GASTOWN_CONTAINER_TOKEN: 'tok-prewarm',
       });
       expect(env?.KILO_CONFIG_CONTENT).toBeTruthy();
+      expect(env?.KILO_PLATFORM).toBe('gastown');
+      expect(env?.KILO_AUTH_CONTENT).toBe(JSON.stringify({ kilo: { type: 'api', key: 'kc-tok' } }));
+      expect(env?.KILO_ORG_ID).toBeUndefined();
     } finally {
       globalThis.fetch = originalFetch;
       if (prev.apiUrl !== undefined) process.env.GASTOWN_API_URL = prev.apiUrl;
@@ -278,6 +296,8 @@ describe('awaitHydration', () => {
       else delete process.env.GASTOWN_TOWN_ID;
       if (prev.token !== undefined) process.env.GASTOWN_CONTAINER_TOKEN = prev.token;
       else delete process.env.GASTOWN_CONTAINER_TOKEN;
+      if (prev.kiloOrgId !== undefined) process.env.KILO_ORG_ID = prev.kiloOrgId;
+      else delete process.env.KILO_ORG_ID;
     }
   });
 
diff --git a/services/gastown/container/src/process-manager.ts b/services/gastown/container/src/process-manager.ts
index c0e243d92a..ef8a51bf35 100644
--- a/services/gastown/container/src/process-manager.ts
+++ b/services/gastown/container/src/process-manager.ts
@@ -9,10 +9,11 @@
 import { createKilo, type KiloClient } from '@kilocode/sdk';
 import { z } from 'zod';
 import * as fs from 'node:fs/promises';
-import type { ManagedAgent, StartAgentRequest } from './types';
+import { type ManagedAgent, StartAgentRequest } from './types';
 import { reportAgentCompleted, reportMayorWaiting } from './completion-reporter';
 import {
   buildKiloConfigContent,
+  buildKiloAuthEnv,
   ensureMayorWorkspaceForTown,
   mayorWorkdirForTown,
 } from './agent-runner';
@@ -31,6 +32,15 @@ const MANAGER_LOG = '[process-manager]';
 // if the SDK changes its return type.
 const SessionResponse = z.object({ id: z.string().min(1) }).passthrough();
 
+const ContainerRegistryResponse = z.object({ data: z.unknown() }).passthrough();
+const ContainerRegistryEntry = z.object({
+  agentId: z.string().min(1),
+  request: StartAgentRequest,
+  workdir: z.string().min(1),
+  env: z.record(z.string(), z.string()),
+});
+type ContainerRegistryEntry = z.infer<typeof ContainerRegistryEntry>;
+
 type SDKInstance = {
   client: KiloClient;
   server: { url: string; close(): void };
@@ -2772,6 +2782,8 @@ function buildPrewarmEnv(ctx: MayorPrewarmContext, townId: string): Record<strin
     env.GH_TOKEN = ghToken;
   }
 
+  Object.assign(env, buildKiloAuthEnv(kilocodeToken, organizationId));
+
   // Without the worker-resolved model, skip prewarm: any guess we make
   // here will almost certainly differ from /agents/start's resolved
   // model and trigger ensureSDKServer's eviction-and-respawn path,
@@ -2906,67 +2918,121 @@ async function bootHydrationImpl(LOG: string): Promise<void> {
 
   console.log(`${LOG} Fetching container registry for town=${townId}`);
   let registry: unknown;
+  const registryFetchStart = Date.now();
   try {
     const resp = await fetch(`${apiUrl}/api/towns/${townId}/container-registry`, {
       headers: { Authorization: `Bearer ${token}` },
       signal: AbortSignal.timeout(10_000),
     });
+    const registryFetchMs = Date.now() - registryFetchStart;
+    log.info('bootHydration.registry_fetch_ms', {
+      townId,
+      durationMs: registryFetchMs,
+      statusCode: resp.status,
+    });
+    postEventToWorker('bootHydration.registry_fetch_ms', { durationMs: registryFetchMs });
     if (!resp.ok) {
       console.warn(`${LOG} Failed to fetch registry: ${resp.status}`);
       return;
     }
-    const json = (await resp.json()) as { data: unknown };
-    registry = json.data;
+    registry = ContainerRegistryResponse.parse(await resp.json()).data;
   } catch (err) {
+    const registryFetchMs = Date.now() - registryFetchStart;
+    log.warn('bootHydration.registry_fetch_ms', {
+      townId,
+      durationMs: registryFetchMs,
+      error: err instanceof Error ? err.message : String(err),
+    });
+    postEventToWorker('bootHydration.registry_fetch_ms', {
+      durationMs: registryFetchMs,
+      error: err instanceof Error ? err.message : String(err),
+    });
     console.warn(`${LOG} Registry fetch failed:`, err);
     return;
   }
 
-  if (!Array.isArray(registry) || registry.length === 0) {
+  const registryEntries = parseRegistryEntries(LOG, registry);
+  if (registryEntries.length === 0) {
     console.log(`${LOG} No agents in registry — nothing to hydrate`);
   } else {
-    console.log(`${LOG} Resuming ${registry.length} agent(s) from registry`);
-
-    for (const entry of registry as Record<string, unknown>[]) {
-      const agentId = entry.agentId as string | undefined;
-      const agentRequest = entry.request as StartAgentRequest | undefined;
-      const workdir = entry.workdir as string | undefined;
-      const env = entry.env as Record<string, string> | undefined;
-
-      if (!agentId || !agentRequest || !workdir || !env) {
-        console.warn(`${LOG} Skipping malformed registry entry:`, entry);
-        continue;
-      }
+    console.log(`${LOG} Resuming ${registryEntries.length} agent(s) from registry`);
+  }
 
-      // Registry entries were written with the token snapshot at dispatch
-      // time. If we just refreshed, overlay the fresh value so the hydrated
-      // kilo serve child inherits the current token.
-      const hydratedEnv = { ...env, GASTOWN_CONTAINER_TOKEN: token };
+  const mayorEntries = registryEntries.filter(entry => entry.request.role === 'mayor');
+  const nonMayorEntries = registryEntries.filter(entry => !mayorEntries.includes(entry));
 
-      console.log(`${LOG} Resuming agent ${agentId} in ${workdir}`);
-      try {
-        await startAgent(agentRequest, workdir, hydratedEnv);
-        console.log(`${LOG} Agent ${agentId} resumed`);
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`${LOG} Failed to resume agent ${agentId}:`, msg);
-      }
+  if (mayorEntries.length > 0) {
+    const mayorResumeStart = Date.now();
+    await resumeRegistryEntries(LOG, mayorEntries, token);
+    const mayorResumeMs = Date.now() - mayorResumeStart;
+    log.info('bootHydration.mayor_resume_ms', { townId, durationMs: mayorResumeMs });
+    postEventToWorker('bootHydration.mayor_resume_ms', { durationMs: mayorResumeMs });
+  } else {
+    const mayorPrewarmStart = Date.now();
+    try {
+      await prewarmMayorSDK(townId, apiUrl, token);
+    } catch (err) {
+      console.warn(`${LOG} Mayor SDK prewarm failed:`, err);
+    } finally {
+      const mayorPrewarmMs = Date.now() - mayorPrewarmStart;
+      log.info('bootHydration.mayor_prewarm_ms', { townId, durationMs: mayorPrewarmMs });
+      postEventToWorker('bootHydration.mayor_prewarm_ms', { durationMs: mayorPrewarmMs });
     }
   }
 
-  const mayorAlreadyResumed = (Array.isArray(registry) ? registry : []).some(
-    (e: unknown) =>
-      typeof e === 'object' &&
-      e !== null &&
-      'request' in e &&
-      typeof (e as { request?: { role?: string } }).request?.role === 'string' &&
-      (e as { request: { role: string } }).request.role === 'mayor'
-  );
-  if (!mayorAlreadyResumed) {
+  if (nonMayorEntries.length > 0) {
+    setTimeout(() => {
+      void (async () => {
+        const nonMayorResumeStart = Date.now();
+        await resumeRegistryEntries(LOG, nonMayorEntries, token);
+        const nonMayorResumeMs = Date.now() - nonMayorResumeStart;
+        log.info('bootHydration.non_mayor_resume_ms', {
+          townId,
+          durationMs: nonMayorResumeMs,
+          count: nonMayorEntries.length,
+        });
+        postEventToWorker('bootHydration.non_mayor_resume_ms', {
+          durationMs: nonMayorResumeMs,
+          count: nonMayorEntries.length,
+        });
+      })();
+    }, 0);
+  }
+}
+
+async function resumeRegistryEntries(
+  LOG: string,
+  entries: ContainerRegistryEntry[],
+  token: string
+): Promise<void> {
+  for (const entry of entries) {
+    // Registry entries were written with the token snapshot at dispatch
+    // time. If we just refreshed, overlay the fresh value so the hydrated
+    // kilo serve child inherits the current token.
+    const hydratedEnv = { ...entry.env, GASTOWN_CONTAINER_TOKEN: token };
+
+    console.log(`${LOG} Resuming agent ${entry.agentId} in ${entry.workdir}`);
     try {
-      await prewarmMayorSDK(townId, apiUrl, token);
+      await startAgent(entry.request, entry.workdir, hydratedEnv);
+      console.log(`${LOG} Agent ${entry.agentId} resumed`);
     } catch (err) {
-      console.warn(`${LOG} Mayor SDK prewarm failed:`, err);
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`${LOG} Failed to resume agent ${entry.agentId}:`, msg);
+    }
+  }
+}
+
+function parseRegistryEntries(LOG: string, registry: unknown): ContainerRegistryEntry[] {
+  if (!Array.isArray(registry)) return [];
+
+  const entries: ContainerRegistryEntry[] = [];
+  for (const entry of registry) {
+    const parsed = ContainerRegistryEntry.safeParse(entry);
+    if (!parsed.success) {
+      console.warn(`${LOG} Skipping malformed registry entry:`, parsed.error.issues);
+      continue;
     }
+    entries.push(parsed.data);
   }
+  return entries;
 }
diff --git a/services/gastown/docs/post-deploy-monitoring.md b/services/gastown/docs/post-deploy-monitoring.md
index 94e4122380..3ac0e96317 100644
--- a/services/gastown/docs/post-deploy-monitoring.md
+++ b/services/gastown/docs/post-deploy-monitoring.md
@@ -5,13 +5,19 @@ Guide for an AI agent to verify town health after a production deploy.
 ## Prerequisites
 
 - The debug endpoint is deployed: `GET /debug/towns/:townId/status`
-- The debug endpoint is protected by Cloudflare Access. Requests must include service token headers.
+- The debug endpoint is protected by Cloudflare Access. Requests must include a Cloudflare Access JWT.
 - Base URL: `https://gastown.kiloapps.io`
 - Town ID: obtain from `GET /trpc/gastown.listOrgTowns` (requires auth) or from the user
 
 ### Authentication
 
-The debug endpoint requires Cloudflare Access service token headers. These are the same credentials the Next.js app uses to communicate with gastown:
+The debug endpoint requires a Cloudflare Access token. For interactive debugging, obtain one with `cloudflared`:
+
+```bash
+export CF_ACCESS_TOKEN="$(cloudflared access login --no-verbose https://gastown.kiloapps.io/debug/login)"
+```
+
+Service token headers also work when using the same credentials the Next.js app uses to communicate with gastown:
 
 ```bash
 # Set these from your Cloudflare Access service token
@@ -28,14 +34,18 @@ export GASTOWN_CF_ANALYTICS_API_KEY="<api-token>"
 export CF_ACCOUNT_ID="<account-id>"
 ```
 
-All `curl` commands in this document use a helper function that includes these headers:
+All `curl` commands in this document use a helper function. Prefer the interactive token when available; fall back to service token headers if set:
 
 ```bash
 debug_curl() {
-  curl -s \
-    -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
-    -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
-    "$@"
+  if [ -n "${CF_ACCESS_TOKEN:-}" ]; then
+    curl -s -H "Cf-Access-Jwt-Assertion: $CF_ACCESS_TOKEN" "$@"
+  else
+    curl -s \
+      -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
+      -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
+      "$@"
+  fi
 }
 ```
 
@@ -44,8 +54,7 @@ debug_curl() {
 The monitoring script at `scripts/monitor-town.sh` polls the debug endpoint:
 
 ```bash
-export CF_ACCESS_CLIENT_ID="<client-id>"
-export CF_ACCESS_CLIENT_SECRET="<client-secret>"
+export CF_ACCESS_TOKEN="$(cloudflared access login --no-verbose https://gastown.kiloapps.io/debug/login)"
 ./scripts/monitor-town.sh <townId> [interval_seconds]
 ```
 
diff --git a/services/gastown/scripts/monitor-town.sh b/services/gastown/scripts/monitor-town.sh
index ef3075e56c..c4b3e4f74c 100755
--- a/services/gastown/scripts/monitor-town.sh
+++ b/services/gastown/scripts/monitor-town.sh
@@ -2,7 +2,9 @@
 # Continuously monitor a town's state via the debug endpoint.
 # Usage: ./scripts/monitor-town.sh [townId] [interval_seconds]
 #
-# Requires Cloudflare Access service token credentials:
+# Requires Cloudflare Access credentials. Prefer an interactive JWT:
+#   export CF_ACCESS_TOKEN="$(cloudflared access login --no-verbose https://gastown.kiloapps.io/debug/login)"
+# Or use service token credentials:
 #   export CF_ACCESS_CLIENT_ID="<service-token-client-id>"
 #   export CF_ACCESS_CLIENT_SECRET="<service-token-client-secret>"
 
@@ -11,9 +13,9 @@ INTERVAL="${2:-15}"
 BASE_URL="${GASTOWN_URL:-https://gastown.kiloapps.io}"
 URL="${BASE_URL}/debug/towns/${TOWN_ID}/status"
 
-if [ -z "$CF_ACCESS_CLIENT_ID" ] || [ -z "$CF_ACCESS_CLIENT_SECRET" ]; then
-  echo "Error: CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET must be set"
-  echo "These are the Cloudflare Access service token credentials."
+if [ -z "${CF_ACCESS_TOKEN:-}" ] && { [ -z "${CF_ACCESS_CLIENT_ID:-}" ] || [ -z "${CF_ACCESS_CLIENT_SECRET:-}" ]; }; then
+  echo "Error: CF_ACCESS_TOKEN or CF_ACCESS_CLIENT_ID/CF_ACCESS_CLIENT_SECRET must be set"
+  echo "Run: export CF_ACCESS_TOKEN=\"\$(cloudflared access login --no-verbose https://gastown.kiloapps.io/debug/login)\""
   exit 1
 fi
 
@@ -23,10 +25,16 @@ echo "Press Ctrl+C to stop"
 echo "=========================================="
 
 while true; do
-  RESP=$(curl -s --max-time 10 \
-    -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
-    -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
-    "${URL}" 2>/dev/null)
+  if [ -n "${CF_ACCESS_TOKEN:-}" ]; then
+    RESP=$(curl -s --max-time 10 \
+      -H "Cf-Access-Jwt-Assertion: $CF_ACCESS_TOKEN" \
+      "${URL}" 2>/dev/null)
+  else
+    RESP=$(curl -s --max-time 10 \
+      -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
+      -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
+      "${URL}" 2>/dev/null)
+  fi
   if [ -z "$RESP" ]; then
     echo "$(date -u +%H:%M:%S)  [ERROR] No response from ${URL}"
     sleep "$INTERVAL"
diff --git a/services/gastown/src/db/tables/bead-events.table.ts b/services/gastown/src/db/tables/bead-events.table.ts
index 1a9ac8219b..3f2937e748 100644
--- a/services/gastown/src/db/tables/bead-events.table.ts
+++ b/services/gastown/src/db/tables/bead-events.table.ts
@@ -24,6 +24,7 @@ export const BeadEventType = z.enum([
   'escalation_rate_spike',
   'agent_restart_loop',
   'rework_requested',
+  'babysit_started',
 ]);
 
 export type BeadEventType = z.infer<typeof BeadEventType>;
diff --git a/services/gastown/src/dos/Town.do.ts b/services/gastown/src/dos/Town.do.ts
index b96d5da0fc..336c7ab210 100644
--- a/services/gastown/src/dos/Town.do.ts
+++ b/services/gastown/src/dos/Town.do.ts
@@ -71,6 +71,7 @@ import { kiloTokenPayload } from '@kilocode/worker-utils';
 import { jwtVerify } from 'jose';
 import { generateKiloApiToken } from '../util/kilo-token.util';
 import { resolveSecret } from '../util/secret.util';
+import { parseGitUrl } from '../util/platform-pr.util';
 import { writeEvent, type GastownEventData } from '../util/analytics.util';
 import { logger, withLogTags } from '../util/log.util';
 import { BeadPriority } from '../types';
@@ -954,105 +955,17 @@ export class TownDO extends DurableObject<Env> {
   /**
    * Push config-derived env vars to the running container. Called after
    * updateTownConfig so that settings changes take effect without a
-   * container restart. New agent processes inherit the updated values.
-   *
-   * Two-phase push:
-   *  1. setEnvVar — persists to DO storage for next boot
-   *  2. POST /sync-config — hot-swaps process.env on the running container
+   * container restart. New agent processes receive current env through
+   * their start requests.
    */
   async syncConfigToContainer(): Promise<void> {
     const townId = this.townId;
     if (!townId) return;
-    const townConfig = await this.getTownConfig();
     const container = getTownContainerStub(this.env, townId);
 
-    // Resolve a fresh GitHub token here too — this method runs both at
-    // initial config push and on every config change, so the persisted
-    // GIT_TOKEN must be live rather than the stale value stored in
-    // git_auth.github_token from rig creation. The container's
-    // syncTownConfigToProcessEnv path reads `git_auth.github_token`
-    // from the X-Town-Config header on every request, so the in-process
-    // GIT_TOKEN follows the same source-of-truth as the persisted one.
-    const githubToken = await scm.resolveGitHubTokenString({
-      env: this.env,
-      townId,
-      getTownConfig: () => Promise.resolve(townConfig),
-    });
-
-    // Phase 1: Persist to DO storage for next boot.
-    const envMapping: Array<[string, string | undefined]> = [
-      ['GIT_TOKEN', githubToken ?? undefined],
-      ['GITLAB_TOKEN', townConfig.git_auth?.gitlab_token],
-      ['GITLAB_INSTANCE_URL', townConfig.git_auth?.gitlab_instance_url],
-      ['GITHUB_CLI_PAT', townConfig.github_cli_pat],
-      ['GASTOWN_GIT_AUTHOR_NAME', townConfig.git_author_name],
-      ['GASTOWN_GIT_AUTHOR_EMAIL', townConfig.git_author_email],
-      ['GASTOWN_DISABLE_AI_COAUTHOR', townConfig.disable_ai_coauthor ? '1' : undefined],
-      ['KILOCODE_TOKEN', townConfig.kilocode_token],
-    ];
-
-    for (const [key, value] of envMapping) {
-      try {
-        if (value) {
-          await container.setEnvVar(key, value);
-        } else {
-          await container.deleteEnvVar(key);
-        }
-      } catch (err) {
-        console.warn(`[Town.do] syncConfigToContainer: ${key} sync failed:`, err);
-      }
-    }
-
-    // Persist custom env_vars to DO storage so they survive container restarts.
-    // Compare against the previously-persisted set of keys to clear removed ones.
-    // Reserved infra keys are never overwritten or deleted — infra values always win.
-    const RESERVED_ENV_KEYS = new Set([
-      'KILOCODE_TOKEN',
-      'GIT_TOKEN',
-      'GITHUB_TOKEN',
-      'GITLAB_TOKEN',
-      'GITLAB_INSTANCE_URL',
-      'GITHUB_CLI_PAT',
-      'GH_TOKEN',
-      'GASTOWN_GIT_AUTHOR_NAME',
-      'GASTOWN_GIT_AUTHOR_EMAIL',
-      'GASTOWN_DISABLE_AI_COAUTHOR',
-      'GASTOWN_ORGANIZATION_ID',
-      'GASTOWN_CONTAINER_TOKEN',
-      'GASTOWN_SESSION_TOKEN',
-      'GASTOWN_API_URL',
-    ]);
-    const CUSTOM_ENV_KEYS_STORAGE_KEY = 'container:custom_env_var_keys';
-    const prevCustomKeys: string[] =
-      (await this.ctx.storage.get<string[]>(CUSTOM_ENV_KEYS_STORAGE_KEY)) ?? [];
-    const newCustomKeys = Object.keys(townConfig.env_vars).filter(
-      key => !RESERVED_ENV_KEYS.has(key)
-    );
-    const newCustomKeySet = new Set(newCustomKeys);
-
-    for (const key of prevCustomKeys) {
-      if (RESERVED_ENV_KEYS.has(key)) continue;
-      if (!newCustomKeySet.has(key)) {
-        try {
-          await container.deleteEnvVar(key);
-        } catch (err) {
-          console.warn(`[Town.do] syncConfigToContainer: delete custom ${key} failed:`, err);
-        }
-      }
-    }
-    for (const [key, value] of Object.entries(townConfig.env_vars)) {
-      if (RESERVED_ENV_KEYS.has(key)) continue;
-      try {
-        await container.setEnvVar(key, value);
-      } catch (err) {
-        console.warn(`[Town.do] syncConfigToContainer: set custom ${key} failed:`, err);
-      }
-    }
-    await this.ctx.storage.put(CUSTOM_ENV_KEYS_STORAGE_KEY, newCustomKeys);
-
-    // Phase 2: Push to the running container's process.env via the
-    // /sync-config endpoint. The X-Town-Config header delivers the
-    // full config; the endpoint applies CONFIG_ENV_MAP to process.env.
+    // Push to the running container's process.env via the /sync-config
+    // endpoint. The X-Town-Config header delivers the full config; the
+    // endpoint applies CONFIG_ENV_MAP to process.env.
     try {
       const containerConfig = await config.buildContainerConfig(
         this.ctx.storage,
@@ -1162,19 +1075,6 @@ export class TownDO extends DurableObject<Env> {
       }
     }
 
-    const token = rigConfig.kilocodeToken ?? (await this.resolveKilocodeToken());
-    if (token) {
-      try {
-        const container = getTownContainerStub(this.env, this.townId);
-        await container.setEnvVar('KILOCODE_TOKEN', token);
-        logger.info('configureRig: stored KILOCODE_TOKEN on TownContainerDO');
-      } catch (err) {
-        logger.warn('configureRig: failed to store token on container DO', {
-          error: err instanceof Error ? err.message : String(err),
-        });
-      }
-    }
-
     logger.info('configureRig: proactively starting container');
     await this.armAlarmIfNeeded();
     try {
@@ -1720,6 +1620,10 @@ export class TownDO extends DurableObject<Env> {
   // ── Agent Events (delegated to AgentDO) ───────────────────────────
 
   async appendAgentEvent(agentId: string, eventType: string, data: unknown): Promise<number> {
+    agents.touchAgent(this.sql, agentId, {
+      lastEventType: eventType,
+      lastEventAt: new Date().toISOString(),
+    });
     const agentDO = getAgentDOStub(this.env, agentId);
     return agentDO.appendEvent(eventType, data);
   }
@@ -1842,6 +1746,10 @@ export class TownDO extends DurableObject<Env> {
   }
 
   async updateAgentStatusMessage(agentId: string, message: string): Promise<void> {
+    agents.touchAgent(this.sql, agentId, {
+      lastEventType: 'agent_status',
+      lastEventAt: new Date().toISOString(),
+    });
     agents.updateAgentStatusMessage(this.sql, agentId, message);
     const agent = agents.getAgent(this.sql, agentId);
     if (agent?.current_hook_bead_id) {
@@ -2632,6 +2540,217 @@ export class TownDO extends DurableObject<Env> {
     return { bead, agent: hookedAgent };
   }
 
+  async slingExistingPr(input: {
+    rigId: string;
+    prUrl: string;
+    title?: string;
+    body?: string;
+    forcePushAllowed?: boolean;
+    sourceAgentId?: string;
+  }): Promise<{ beadId: string; warning?: string }> {
+    const rig = rigs.getRig(this.sql, input.rigId);
+    if (!rig) {
+      throw new Error(`Rig not found: ${input.rigId}`);
+    }
+
+    const townConfig = await this.getTownConfig();
+    const rigCoords = parseGitUrl(rig.git_url, townConfig.git_auth?.gitlab_instance_url);
+    if (!rigCoords) {
+      throw new Error(`Cannot parse rig git URL: ${rig.git_url}`);
+    }
+
+    const prUrlMatch = input.prUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+    const glUrlMatch = input.prUrl.match(/^(https:\/\/[^/]+)\/(.+)\/-\/merge_requests\/(\d+)/);
+
+    let prOwner: string | undefined;
+    let prRepo: string | undefined;
+    let prPlatform: 'github' | 'gitlab' | undefined;
+
+    if (prUrlMatch) {
+      prPlatform = 'github';
+      prOwner = prUrlMatch[1];
+      prRepo = prUrlMatch[2];
+    } else if (glUrlMatch) {
+      const glHost = new URL(glUrlMatch[1]).hostname;
+      const configuredGlHost = townConfig.git_auth?.gitlab_instance_url
+        ? new URL(townConfig.git_auth.gitlab_instance_url).hostname
+        : null;
+      if (glHost === 'gitlab.com' || glHost === configuredGlHost) {
+        prPlatform = 'gitlab';
+        const fullPath = glUrlMatch[2];
+        const lastSlash = fullPath.lastIndexOf('/');
+        prOwner = lastSlash > 0 ? fullPath.slice(0, lastSlash) : fullPath;
+        prRepo = lastSlash > 0 ? fullPath.slice(lastSlash + 1) : '';
+      }
+    }
+
+    if (!prPlatform || !prOwner || !prRepo) {
+      throw new Error(`Cannot parse PR URL: ${input.prUrl}`);
+    }
+
+    if (
+      prPlatform !== rigCoords.platform ||
+      prOwner !== rigCoords.owner ||
+      prRepo !== rigCoords.repo
+    ) {
+      throw new Error(
+        'PR URL repo does not match rig repo. Cannot adopt PRs from other repositories.'
+      );
+    }
+
+    const rigConfig = await this.getRigConfig(input.rigId);
+    const scmCtx: scm.SCMContext = {
+      env: this.env,
+      townId: this.townId,
+      getTownConfig: () => this.getTownConfig(),
+      platformIntegrationId: rigConfig?.platformIntegrationId,
+    };
+
+    const outcome = await scm.checkPRStatus(scmCtx, input.prUrl);
+    if (!outcome.ok) {
+      const err = outcome.error;
+      throw new Error(
+        `Failed to fetch PR status: ${err.kind}` +
+          (err.kind === 'http_error' ? ` (${err.status} ${err.statusText})` : '') +
+          (err.kind === 'no_token' ? ` — tried: ${err.resolutionChain.join(', ')}` : '')
+      );
+    }
+
+    const prResult = outcome.result;
+    if (prResult.status === 'merged' || prResult.status === 'closed') {
+      throw new Error(`Cannot babysit a PR that is already ${prResult.status}.`);
+    }
+
+    const headBranch = prResult.head_branch;
+    const baseBranch = prResult.base_branch;
+    const headSha = prResult.head_sha;
+    const prTitle = prResult.title;
+
+    if (!headBranch || !baseBranch || !headSha) {
+      throw new Error(
+        `PR metadata incomplete — missing head_branch, base_branch, or head_sha. ` +
+          `head_branch=${headBranch ?? 'missing'}, base_branch=${baseBranch ?? 'missing'}, head_sha=${headSha ?? 'missing'}`
+      );
+    }
+
+    const title = input.title ?? `Babysit: ${prTitle ?? input.prUrl}`;
+    const body =
+      input.body ??
+      `Adopted external PR ${input.prUrl} at SHA ${headSha}. Town will poll and address review feedback, conflicts, and auto-merge.`;
+
+    const { beadId } = reviewQueue.submitExternalPrToReviewQueue(this.sql, {
+      rigId: input.rigId,
+      prUrl: input.prUrl,
+      branch: headBranch,
+      targetBranch: baseBranch,
+      headSha,
+      title,
+      body,
+      forcePushAllowed: input.forcePushAllowed ?? false,
+      sourceAgentId: input.sourceAgentId ?? 'mayor',
+    });
+
+    events.insertEvent(this.sql, 'bead_created', {
+      bead_id: beadId,
+      payload: { bead_type: 'merge_request', rig_id: input.rigId, babysit: true },
+    });
+
+    await this.escalateToActiveCadence();
+
+    let warning: string | undefined;
+    const effectiveConfig = config.resolveRigConfig(townConfig, rig.config ?? null);
+    if (effectiveConfig.code_review) {
+      warning =
+        'This rig has code review enabled. Babysat PRs bypass refinery code review — the town will poll and auto-merge instead of dispatching a refinery.';
+    }
+
+    return { beadId, warning };
+  }
+
+  async previewPr(input: { rigId: string; prUrl: string }): Promise<{
+    state: string;
+    head_branch?: string;
+    base_branch?: string;
+    head_sha?: string;
+    title?: string;
+    repo_matches: boolean;
+  }> {
+    const rig = rigs.getRig(this.sql, input.rigId);
+    if (!rig) {
+      throw new Error(`Rig not found: ${input.rigId}`);
+    }
+
+    const townConfig = await this.getTownConfig();
+    const rigCoords = parseGitUrl(rig.git_url, townConfig.git_auth?.gitlab_instance_url);
+    if (!rigCoords) {
+      throw new Error(`Cannot parse rig git URL: ${rig.git_url}`);
+    }
+
+    const prUrlMatch = input.prUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+    const glUrlMatch = input.prUrl.match(/^(https:\/\/[^/]+)\/(.+)\/-\/merge_requests\/(\d+)/);
+
+    let prOwner: string | undefined;
+    let prRepo: string | undefined;
+    let prPlatform: 'github' | 'gitlab' | undefined;
+
+    if (prUrlMatch) {
+      prPlatform = 'github';
+      prOwner = prUrlMatch[1];
+      prRepo = prUrlMatch[2];
+    } else if (glUrlMatch) {
+      const glHost = new URL(glUrlMatch[1]).hostname;
+      const configuredGlHost = townConfig.git_auth?.gitlab_instance_url
+        ? new URL(townConfig.git_auth.gitlab_instance_url).hostname
+        : null;
+      if (glHost === 'gitlab.com' || glHost === configuredGlHost) {
+        prPlatform = 'gitlab';
+        const fullPath = glUrlMatch[2];
+        const lastSlash = fullPath.lastIndexOf('/');
+        prOwner = lastSlash > 0 ? fullPath.slice(0, lastSlash) : fullPath;
+        prRepo = lastSlash > 0 ? fullPath.slice(lastSlash + 1) : '';
+      }
+    }
+
+    if (!prPlatform || !prOwner || !prRepo) {
+      throw new Error(`Cannot parse PR URL: ${input.prUrl}`);
+    }
+
+    const repoMatches =
+      prPlatform === rigCoords.platform && prOwner === rigCoords.owner && prRepo === rigCoords.repo;
+
+    if (!repoMatches) {
+      return { state: 'unknown', repo_matches: false };
+    }
+
+    const rigConfig = await this.getRigConfig(input.rigId);
+    const scmCtx: scm.SCMContext = {
+      env: this.env,
+      townId: this.townId,
+      getTownConfig: () => this.getTownConfig(),
+      platformIntegrationId: rigConfig?.platformIntegrationId,
+    };
+
+    const outcome = await scm.checkPRStatus(scmCtx, input.prUrl);
+    if (!outcome.ok) {
+      const err = outcome.error;
+      throw new Error(
+        `Failed to fetch PR status: ${err.kind}` +
+          (err.kind === 'http_error' ? ` (${err.status} ${err.statusText})` : '') +
+          (err.kind === 'no_token' ? ` — tried: ${err.resolutionChain.join(', ')}` : '')
+      );
+    }
+
+    const prResult = outcome.result;
+    return {
+      state: prResult.status,
+      head_branch: prResult.head_branch,
+      base_branch: prResult.base_branch,
+      head_sha: prResult.head_sha,
+      title: prResult.title,
+      repo_matches: true,
+    };
+  }
+
   /**
    * Create an open bead with the given labels, without arming the reconciler alarm.
    * The caller is responsible for including `gt:held` in the labels if the bead
@@ -2841,15 +2960,6 @@ export class TownDO extends DurableObject<Env> {
         orgId: townConfig.organization_id,
       });
 
-      if (kilocodeToken) {
-        try {
-          const containerStub = getTownContainerStub(this.env, townId);
-          await containerStub.setEnvVar('KILOCODE_TOKEN', kilocodeToken);
-        } catch {
-          // Best effort
-        }
-      }
-
       const { started: mayorStarted } = await dispatch.startAgentInContainer(
         this.env,
         this.ctx.storage,
@@ -3051,13 +3161,6 @@ export class TownDO extends DurableObject<Env> {
       label: 'fresh_dispatch',
     });
 
-    try {
-      const containerStub = getTownContainerStub(this.env, townId);
-      await containerStub.setEnvVar('KILOCODE_TOKEN', kilocodeToken);
-    } catch {
-      // Best effort
-    }
-
     // Start with an empty prompt — the mayor will be idle but its container
     // and SDK server will be running, ready for PTY connections.
     const { started: mayorStarted } = await dispatch.startAgentInContainer(
@@ -4498,10 +4601,9 @@ export class TownDO extends DurableObject<Env> {
   }
 
   /**
-   * Push a fresh container-scoped JWT to the TownContainerDO. Called
+   * Push a fresh container-scoped JWT to the running control server. Called
    * from the alarm handler, throttled to once per hour (tokens have
-   * 8h expiry). The TownContainerDO stores it as an env var so it's
-   * available to all agents in the container.
+   * 8h expiry). New dispatches also pass fresh tokens in their request env.
    *
    * The throttle timestamp is persisted in ctx.storage so it survives
    * DO eviction. Without persistence, eviction resets the throttle to 0
@@ -4998,7 +5100,13 @@ export class TownDO extends DurableObject<Env> {
       // actually starts the container. Already-running containers still rely
       // on the /health probe below as the application-level liveness source.
       try {
-        const warm = await container.warmUp();
+        const townConfig = await this.getTownConfig();
+        const userId = townConfig.owner_user_id ?? townConfig.created_by_user_id ?? townId;
+        const containerToken = await dispatch.mintContainerToken(this.env, { townId, userId });
+        const warm = await container.warmUp({
+          townId,
+          ...(containerToken ? { containerToken } : {}),
+        });
         if (warm.coldStart) {
           writeEvent(this.env, {
             event: 'container.cold_start',
diff --git a/services/gastown/src/dos/TownContainer.do.ts b/services/gastown/src/dos/TownContainer.do.ts
index 2a29ea2504..9221f00f41 100644
--- a/services/gastown/src/dos/TownContainer.do.ts
+++ b/services/gastown/src/dos/TownContainer.do.ts
@@ -22,8 +22,8 @@ export class TownContainerDO extends Container<Env> {
   defaultPort = 8080;
   sleepAfter = '10m';
 
-  // Container env vars. Includes infra URLs and any tokens stored via setEnvVar().
-  // The Container base class reads this when booting the container.
+  // Static boot-time container env vars. Runtime town, rig, and agent
+  // configuration is sent through the control server request protocol.
   envVars: Record<string, string> = {
     ...(this.env.GASTOWN_API_URL ? { GASTOWN_API_URL: this.env.GASTOWN_API_URL } : {}),
     ...(this.env.KILO_API_URL
@@ -34,39 +34,6 @@ export class TownContainerDO extends Container<Env> {
       : {}),
   };
 
-  constructor(ctx: DurableObjectState<Env>, env: Env) {
-    super(ctx, env);
-    // Load persisted env vars (like KILOCODE_TOKEN) into envVars
-    // so they're available when the container boots.
-    void ctx.blockConcurrencyWhile(async () => {
-      const stored = await ctx.storage.get<Record<string, string>>('container:envVars');
-      if (stored) {
-        Object.assign(this.envVars, stored);
-      }
-    });
-  }
-
-  /**
-   * Store an env var that will be injected into the container OS environment.
-   * Takes effect on the next container boot (or immediately if the container
-   * hasn't started yet). Call this from the TownDO during configureRig.
-   */
-  async setEnvVar(key: string, value: string): Promise<void> {
-    const stored = (await this.ctx.storage.get<Record<string, string>>('container:envVars')) ?? {};
-    stored[key] = value;
-    await this.ctx.storage.put('container:envVars', stored);
-    this.envVars[key] = value;
-    console.log(`${TC_LOG} setEnvVar: ${key} stored (${value.length} chars)`);
-  }
-
-  async deleteEnvVar(key: string): Promise<void> {
-    const stored = (await this.ctx.storage.get<Record<string, string>>('container:envVars')) ?? {};
-    delete stored[key];
-    await this.ctx.storage.put('container:envVars', stored);
-    delete this.envVars[key];
-    console.log(`${TC_LOG} deleteEnvVar: ${key} removed`);
-  }
-
   async updateRegistry(registry: unknown): Promise<void> {
     await this.ctx.storage.put('container:registry', registry);
     console.log(
@@ -91,7 +58,10 @@ export class TownContainerDO extends Container<Env> {
    * Returns how long startAndWaitForPorts took when this call actually
    * triggered a cold start.
    */
-  async warmUp(): Promise<{ coldStart: boolean; durationMs: number }> {
+  async warmUp(params: {
+    townId: string;
+    containerToken?: string;
+  }): Promise<{ coldStart: boolean; durationMs: number }> {
     if (this.ctx.container?.running === true) {
       // Runtime-level fast path only. TownDO's /health probe is the
       // application-level liveness source and may still recover a wedged
@@ -99,7 +69,15 @@ export class TownContainerDO extends Container<Env> {
       return { coldStart: false, durationMs: 0 };
     }
     const t0 = Date.now();
-    await this.startAndWaitForPorts();
+    await this.startAndWaitForPorts({
+      startOptions: {
+        envVars: {
+          ...this.envVars,
+          GASTOWN_TOWN_ID: params.townId,
+          ...(params.containerToken ? { GASTOWN_CONTAINER_TOKEN: params.containerToken } : {}),
+        },
+      },
+    });
     return { coldStart: true, durationMs: Date.now() - t0 };
   }
 
diff --git a/services/gastown/src/dos/town/actions.ts b/services/gastown/src/dos/town/actions.ts
index 11ff0adbf5..ea6f42a48f 100644
--- a/services/gastown/src/dos/town/actions.ts
+++ b/services/gastown/src/dos/town/actions.ts
@@ -790,9 +790,18 @@ export function applyAction(ctx: ApplyActionContext, action: Action): (() => Pro
       const rigId = action.rig_id;
 
       if (!agentId) {
+        // Babysat external PRs bypass refinery code review — there's no source
+        // polecat to mail rework to and no source bead to reopen. The user
+        // adopted the PR explicitly to have it merged, not reviewed. The
+        // reconciler will fast-track these to in_progress via transition_bead
+        // instead of dispatching a refinery.
+        const targetBead = beadOps.getBead(sql, beadId);
+        if (targetBead?.type === 'merge_request' && targetBead.metadata?.babysit === true) {
+          return null;
+        }
+
         // Need to get-or-create an agent for this bead.
         // Infer role from bead type: MR beads need refineries, issue beads need polecats.
-        const targetBead = beadOps.getBead(sql, beadId);
         const role = targetBead?.type === 'merge_request' ? 'refinery' : 'polecat';
         try {
           const agent = agentOps.getOrCreateAgent(sql, role, rigId, townId);
diff --git a/services/gastown/src/dos/town/agents.ts b/services/gastown/src/dos/town/agents.ts
index c2b920c13e..ea0d94ee20 100644
--- a/services/gastown/src/dos/town/agents.ts
+++ b/services/gastown/src/dos/town/agents.ts
@@ -475,6 +475,15 @@ export function getOrCreateAgent(
 
 // ── Prime Context ───────────────────────────────────────────────────
 
+/**
+ * Resolve force_push_allowed from bead metadata.
+ * Absent = true (backwards compat for pre-babysit beads).
+ * Only explicit false disables force-push.
+ */
+export function resolveForcePushAllowed(meta: Record<string, unknown>): boolean {
+  return meta.force_push_allowed !== false;
+}
+
 export function prime(sql: SqlStorage, agentId: string): PrimeContext {
   const agent = getAgent(sql, agentId);
   if (!agent) throw new Error(`Agent ${agentId} not found`);
@@ -521,10 +530,12 @@ export function prime(sql: SqlStorage, agentId: string): PrimeContext {
   let pr_fixup_context: PrimeContext['pr_fixup_context'] = null;
   if (hookedBead?.labels.includes('gt:pr-fixup') && hookedBead.metadata) {
     const meta = hookedBead.metadata as Record<string, unknown>;
+    const forcePushAllowed = resolveForcePushAllowed(meta);
     pr_fixup_context = {
       pr_url: typeof meta.pr_url === 'string' ? meta.pr_url : null,
       branch: typeof meta.branch === 'string' ? meta.branch : null,
       target_branch: typeof meta.target_branch === 'string' ? meta.target_branch : null,
+      force_push_allowed: forcePushAllowed,
     };
   }
 
@@ -533,11 +544,13 @@ export function prime(sql: SqlStorage, agentId: string): PrimeContext {
   let pr_conflict_context: PrimeContext['pr_conflict_context'] = null;
   if (hookedBead?.labels.includes('gt:pr-conflict') && hookedBead.metadata) {
     const meta = hookedBead.metadata as Record<string, unknown>;
+    const forcePushAllowed = resolveForcePushAllowed(meta);
     pr_conflict_context = {
       pr_url: typeof meta.pr_url === 'string' ? meta.pr_url : null,
       branch: typeof meta.branch === 'string' ? meta.branch : null,
       target_branch: typeof meta.target_branch === 'string' ? meta.target_branch : null,
       has_feedback: meta.has_feedback === true || meta.has_feedback === 1,
+      force_push_allowed: forcePushAllowed,
     };
   } else if (hookedBead?.labels.includes('gt:pr-feedback') && hookedBead.metadata) {
     // A feedback bead can also have has_conflicts: true when a conflict was detected
@@ -545,12 +558,14 @@ export function prime(sql: SqlStorage, agentId: string): PrimeContext {
     // agent resolves conflicts first, then addresses review feedback.
     const meta = hookedBead.metadata as Record<string, unknown>;
     if (meta.has_conflicts === true || meta.has_conflicts === 1) {
+      const forcePushAllowed = resolveForcePushAllowed(meta);
       pr_conflict_context = {
         pr_url: typeof meta.pr_url === 'string' ? meta.pr_url : null,
         branch: typeof meta.branch === 'string' ? meta.branch : null,
         target_branch:
           typeof meta.conflict_target_branch === 'string' ? meta.conflict_target_branch : null,
         has_feedback: true,
+        force_push_allowed: forcePushAllowed,
       };
     }
   }
@@ -601,7 +616,7 @@ export function updateAgentStatusMessage(sql: SqlStorage, agentId: string, messa
   );
 }
 
-// ── Touch (heartbeat helper) ────────────────────────────────────────
+// ── Touch (container activity helper) ────────────────────────────────
 
 export function touchAgent(
   sql: SqlStorage,
@@ -612,7 +627,7 @@ export function touchAgent(
     activeTools?: string[];
   }
 ): void {
-  // A heartbeat is proof the agent is alive in the container.
+  // A heartbeat, agent event, or status update is proof the agent is alive in the container.
   // If the agent's status is 'idle' (e.g. due to a dispatch timeout
   // race — see #1358), restore it to 'working'. This prevents the
   // reconciler from treating the agent as lost while it's actively
diff --git a/services/gastown/src/dos/town/config.ts b/services/gastown/src/dos/town/config.ts
index 85b3ca4715..8262b8ea1f 100644
--- a/services/gastown/src/dos/town/config.ts
+++ b/services/gastown/src/dos/town/config.ts
@@ -330,6 +330,7 @@ export async function buildContainerConfig(
   }
 
   return {
+    town_id: townId,
     env_vars: config.env_vars,
     default_model: resolveModel(config, null, ''),
     small_model: resolveSmallModel(config),
diff --git a/services/gastown/src/dos/town/container-dispatch.ts b/services/gastown/src/dos/town/container-dispatch.ts
index 0ef2f41da3..6c67a2369e 100644
--- a/services/gastown/src/dos/town/container-dispatch.ts
+++ b/services/gastown/src/dos/town/container-dispatch.ts
@@ -137,15 +137,28 @@ export async function mintAgentToken(
   );
 }
 
+export async function mintContainerToken(
+  env: Env,
+  params: { townId: string; userId: string }
+): Promise<string | null> {
+  const jwtSecret = await resolveJWTSecret(env);
+  if (!jwtSecret) {
+    console.error(`${TOWN_LOG} mintContainerToken: no JWT secret available`);
+    return null;
+  }
+
+  return signContainerJWT({ townId: params.townId, userId: params.userId }, jwtSecret);
+}
+
 /**
- * Mint a container-scoped JWT and push it to the TownContainerDO.
+ * Mint a container-scoped JWT and push it to the town container.
  * One JWT per container — shared by all agents in the town. Carries
  * { townId, userId, scope: 'container' } with 8h expiry.
  *
- * Pushes via both setEnvVar() (for next container boot) and
- * POST /refresh-token (for the running process). This ensures that
- * all code paths — existing agents, heartbeat, event persistence —
- * pick up the fresh token immediately.
+ * Pushes via POST /refresh-token when a container is running. New
+ * dispatches also include the fresh token in their request env. This
+ * ensures active code paths — existing agents, heartbeat, event
+ * persistence — pick up the fresh token immediately.
  *
  * Returns the token so callers can also pass it as a per-agent env var.
  */
@@ -154,44 +167,54 @@ export async function ensureContainerToken(
   townId: string,
   userId: string
 ): Promise<string | null> {
-  const jwtSecret = await resolveJWTSecret(env);
-  if (!jwtSecret) {
-    console.error(`${TOWN_LOG} ensureContainerToken: no JWT secret available`);
+  const mintStart = Date.now();
+  const token = await mintContainerToken(env, { townId, userId });
+  writeEvent(env, {
+    event: 'startAgentInContainer.token_mint_ms',
+    townId,
+    userId,
+    durationMs: Date.now() - mintStart,
+  });
+  if (!token) {
     return null;
   }
 
-  const token = signContainerJWT({ townId, userId }, jwtSecret);
   const container = getTownContainerStub(env, townId);
 
-  // Store for next boot
-  try {
-    await container.setEnvVar('GASTOWN_CONTAINER_TOKEN', token);
-    await container.setEnvVar('GASTOWN_TOWN_ID', townId);
-  } catch (err) {
-    console.warn(
-      `${TOWN_LOG} ensureContainerToken: setEnvVar failed (container may not be running):`,
-      err instanceof Error ? err.message : err
-    );
-  }
-
   // Push to running process so existing agents pick up the fresh token.
   // Throw on non-2xx so the alarm's throttle doesn't advance on failure.
+  const refreshStart = Date.now();
   try {
     const resp = await container.fetch('http://container/refresh-token', {
       method: 'POST',
       signal: AbortSignal.timeout(10_000),
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ token }),
+      body: JSON.stringify({ token, townId }),
     });
     if (!resp.ok) {
       throw new Error(`container returned ${resp.status}`);
     }
+    writeEvent(env, {
+      event: 'startAgentInContainer.refresh_token_ms',
+      townId,
+      userId,
+      durationMs: Date.now() - refreshStart,
+      statusCode: resp.status,
+    });
   } catch (err) {
-    // If the container isn't running yet, the token will be in envVars
-    // when it boots. But if it IS running and rejected the refresh,
-    // propagate the error so the alarm retries on the next tick.
+    // If the container isn't running yet, the next dispatch will include
+    // the token in request env. But if it IS running and rejected the
+    // refresh, propagate the error so the alarm retries on the next tick.
     const isContainerDown =
       err instanceof TypeError || (err instanceof Error && err.message.includes('fetch'));
+    writeEvent(env, {
+      event: 'startAgentInContainer.refresh_token_ms',
+      townId,
+      userId,
+      durationMs: Date.now() - refreshStart,
+      error: err instanceof Error ? err.message : String(err),
+      label: isContainerDown ? 'container_down' : 'failed',
+    });
     if (!isContainerDown) throw err;
   }
 
@@ -209,43 +232,30 @@ export const refreshContainerToken = ensureContainerToken;
 /**
  * Force-refresh variant for manual user-triggered refreshes.
  *
- * Unlike ensureContainerToken (which tolerates a downed container
- * because the token is persisted in envVars for next boot), this
- * function throws on ANY failure to push the token to the running
- * container — including network errors. This ensures the UI reports
- * a real failure instead of a false success when the container
- * never actually received the fresh JWT.
+ * Unlike ensureContainerToken (which tolerates a downed container because
+ * the next dispatch passes fresh request env), this function throws on ANY
+ * failure to push the token to the running container — including network
+ * errors. This ensures the UI reports a real failure instead of a false
+ * success when the container never actually received the fresh JWT.
  */
 export async function forceRefreshContainerToken(
   env: Env,
   townId: string,
   userId: string
 ): Promise<string> {
-  const jwtSecret = await resolveJWTSecret(env);
-  if (!jwtSecret) {
+  const token = await mintContainerToken(env, { townId, userId });
+  if (!token) {
     throw new Error('No JWT secret available — cannot mint container token');
   }
 
-  const token = signContainerJWT({ townId, userId }, jwtSecret);
   const container = getTownContainerStub(env, townId);
 
-  // Store for next boot (best-effort — the critical step is the live push below)
-  try {
-    await container.setEnvVar('GASTOWN_CONTAINER_TOKEN', token);
-    await container.setEnvVar('GASTOWN_TOWN_ID', townId);
-  } catch (err) {
-    console.warn(
-      `${TOWN_LOG} forceRefreshContainerToken: setEnvVar failed:`,
-      err instanceof Error ? err.message : err
-    );
-  }
-
   // Push to running container — propagate ALL errors so the caller
   // (and ultimately the UI) knows the refresh didn't land.
   const resp = await container.fetch('http://container/refresh-token', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ token }),
+    body: JSON.stringify({ token, townId }),
   });
   if (!resp.ok) {
     const body = await resp.text().catch(() => '');
@@ -417,8 +427,24 @@ export async function startAgentInContainer(
   try {
     // Mint a container-scoped JWT (8h expiry, refreshed by TownDO alarm).
     // One token per container — shared by all agents in the town.
-    // Carries { townId, userId, scope: 'container' }.
-    const containerToken = await ensureContainerToken(env, params.townId, params.userId);
+    // Carries { townId, userId, scope: 'container' }. Fresh dispatches
+    // pass the token in /agents/start instead of first pushing
+    // /refresh-token, keeping cold starts off the extra live request path.
+    // Already-running agents receive token rotation from the alarm or
+    // explicit refresh paths rather than this user-visible startup path.
+    const tokenMintStart = Date.now();
+    const containerToken = await mintContainerToken(env, {
+      townId: params.townId,
+      userId: params.userId,
+    });
+    writeEvent(env, {
+      event: 'startAgentInContainer.token_mint_ms',
+      townId: params.townId,
+      userId: params.userId,
+      agentId: params.agentId,
+      role: params.role,
+      durationMs: Date.now() - tokenMintStart,
+    });
 
     // Also mint a per-agent JWT as fallback during rollout.
     const agentToken = await mintAgentToken(env, {
@@ -479,6 +505,9 @@ export async function startAgentInContainer(
     }
 
     // Container token is preferred (shared by all agents, refreshed by alarm).
+    // This freshly minted token is for the agent being started; it is not
+    // pushed to existing SDK children here so mayor cold starts avoid a
+    // pre-start /refresh-token request.
     // Legacy per-agent JWT kept as fallback during rollout.
     if (containerToken) envVars.GASTOWN_CONTAINER_TOKEN = containerToken;
     if (agentToken) envVars.GASTOWN_SESSION_TOKEN = agentToken;
diff --git a/services/gastown/src/dos/town/reconciler.ts b/services/gastown/src/dos/town/reconciler.ts
index 17f72ac47c..831a5488e2 100644
--- a/services/gastown/src/dos/town/reconciler.ts
+++ b/services/gastown/src/dos/town/reconciler.ts
@@ -45,6 +45,7 @@ import {
   isAlreadyReported,
   type ReporterBead,
 } from './wasteland-reporter';
+import { HEARTBEAT_STALE_MS, staleMs } from './staleness';
 
 const LOG = '[reconciler]';
 
@@ -131,13 +132,6 @@ const STALE_IN_PROGRESS_TIMEOUT_MS = 5 * 60_000; // 5 min
  * cleanup closes the loop. */
 const STALLED_AUTO_IDLE_MS = 2.5 * 60 * 60_000; // 2h 30min
 
-// ── Helper: staleness check ─────────────────────────────────────────
-
-function staleMs(timestamp: string | null, thresholdMs: number): boolean {
-  if (!timestamp) return true;
-  return Date.now() - new Date(timestamp).getTime() > thresholdMs;
-}
-
 /**
  * Compute the dispatch cooldown for a bead based on its attempt count.
  * Implements exponential backoff:
@@ -728,7 +722,7 @@ export function reconcileAgents(sql: SqlStorage, opts?: { draining?: boolean }):
         to: 'idle',
         reason: 'no heartbeat received since dispatch',
       });
-    } else if (staleMs(agent.last_activity_at, 90_000)) {
+    } else if (staleMs(agent.last_activity_at, HEARTBEAT_STALE_MS)) {
       actions.push({
         type: 'transition_agent',
         agent_id: agent.bead_id,
@@ -907,7 +901,7 @@ export function reconcileAgents(sql: SqlStorage, opts?: { draining?: boolean }):
       // alive and leave the hook in place. The 90s window matches
       // reconcileAgents' stale-heartbeat threshold, so a truly dead
       // agent still gets reaped by the heartbeat path on a later tick.
-      if (!staleMs(agent.last_activity_at, 90_000)) continue;
+      if (!staleMs(agent.last_activity_at, HEARTBEAT_STALE_MS)) continue;
 
       actions.push({
         type: 'unhook_agent',
@@ -1635,6 +1629,40 @@ export function reconcileReviewQueue(
     }
   }
 
+  // Babysat PR fast-track: open MR beads with metadata.babysit=true
+  // bypass refinery code review regardless of the rig's code_review config.
+  // These beads already have pr_url set at creation (from slingExistingPr),
+  // so they transition directly to in_progress for poll_pr.
+  const babysatOpenMrs = z
+    .object({ bead_id: z.string() })
+    .array()
+    .parse([
+      ...query(
+        sql,
+        /* sql */ `
+          SELECT b.${beads.columns.bead_id}
+          FROM ${beads} b
+          JOIN ${review_metadata} rm
+            ON rm.${review_metadata.columns.bead_id} = b.${beads.columns.bead_id}
+          WHERE b.${beads.columns.type} = 'merge_request'
+            AND b.${beads.columns.status} = 'open'
+            AND rm.${review_metadata.columns.pr_url} IS NOT NULL
+            AND json_extract(COALESCE(b.${beads.columns.metadata}, '{}'), '$.babysit') = 1
+        `,
+        []
+      ),
+    ]);
+  for (const { bead_id } of babysatOpenMrs) {
+    actions.push({
+      type: 'transition_bead',
+      bead_id,
+      from: 'open',
+      to: 'in_progress',
+      reason: 'babysat PR — skip refinery, fast-track to poll_pr',
+      actor: 'system',
+    });
+  }
+
   // Rules 5-6: Refinery dispatch for open MR beads.
   // When code_review=true for a rig: dispatches for all open MR beads in that rig.
   // When code_review=false for a rig: only dispatches for convoy review-and-merge
@@ -1741,6 +1769,7 @@ export function reconcileReviewQueue(
           WHERE ${beads.type} = 'merge_request'
             AND ${beads.status} = 'open'
             AND ${beads.rig_id} = ?
+            AND json_extract(COALESCE(${beads.metadata}, '{}'), '$.babysit') IS NOT 1
             ${refineryNeededFilter}
           ORDER BY ${beads.created_at} ASC
           LIMIT 1
diff --git a/services/gastown/src/dos/town/review-queue.ts b/services/gastown/src/dos/town/review-queue.ts
index 3246db07da..3dee94ee07 100644
--- a/services/gastown/src/dos/town/review-queue.ts
+++ b/services/gastown/src/dos/town/review-queue.ts
@@ -28,6 +28,7 @@ import {
 import { getAgent, unhookBead, updateAgentStatus } from './agents';
 import { getRig } from './rigs';
 import type { ReviewQueueInput, ReviewQueueEntry, AgentDoneInput, Molecule } from '../../types';
+import { heartbeatStale } from './staleness';
 
 function generateId(): string {
   return crypto.randomUUID();
@@ -107,41 +108,23 @@ function toReviewQueueEntry(row: MergeRequestBeadRecord): ReviewQueueEntry {
   };
 }
 
-export function submitToReviewQueue(sql: SqlStorage, input: ReviewQueueInput): void {
+function createMergeRequestBeadCore(
+  sql: SqlStorage,
+  args: {
+    rigId: string;
+    title: string;
+    body: string | null;
+    metadata: Record<string, unknown>;
+    labels: string[];
+    createdBy: string | null;
+    branch: string;
+    targetBranch: string;
+    prUrl?: string;
+  }
+): { beadId: string } {
   const id = generateId();
   const timestamp = now();
 
-  // Build metadata — include pr_url if the agent already created a PR so
-  // the link is visible via the standard bead list endpoint.
-  const metadata: Record<string, unknown> = {
-    source_bead_id: input.bead_id,
-    source_agent_id: input.agent_id,
-  };
-  if (input.pr_url) {
-    metadata.pr_url = input.pr_url;
-  }
-
-  // Resolve the target branch for this MR:
-  // - For review-then-land convoy beads → convoy's feature branch
-  // - For review-and-merge convoy beads → rig's default branch (land independently)
-  // - For standalone beads → rig's default branch
-  // We pass defaultBranch from the caller so we don't hardcode 'main'.
-  const convoyId = getConvoyForBead(sql, input.bead_id);
-  const convoyFeatureBranch = convoyId ? getConvoyFeatureBranch(sql, convoyId) : null;
-  const convoyMergeMode = convoyId ? getConvoyMergeMode(sql, convoyId) : null;
-  const targetBranch =
-    convoyMergeMode === 'review-then-land' && convoyFeatureBranch
-      ? convoyFeatureBranch
-      : (input.default_branch ?? 'main');
-
-  if (convoyId) {
-    metadata.convoy_id = convoyId;
-    if (convoyFeatureBranch) {
-      metadata.convoy_feature_branch = convoyFeatureBranch;
-    }
-  }
-
-  // Create the merge_request bead
   query(
     sql,
     /* sql */ `
@@ -158,45 +141,82 @@ export function submitToReviewQueue(sql: SqlStorage, input: ReviewQueueInput): v
       id,
       'merge_request',
       'open',
-      `Review: ${input.branch}`,
-      input.summary ?? null,
-      input.rig_id,
+      args.title,
+      args.body,
+      args.rigId,
+      null,
       null,
-      null, // assignee left null — refinery claims it via hookBead
       'medium',
-      JSON.stringify(['gt:merge-request']),
-      JSON.stringify(metadata),
-      input.agent_id, // created_by records who submitted
+      JSON.stringify(args.labels),
+      JSON.stringify(args.metadata),
+      args.createdBy,
       timestamp,
       timestamp,
       null,
     ]
   );
 
-  // Link MR bead → source bead via bead_dependencies so the DAG is queryable
   query(
     sql,
     /* sql */ `
-      INSERT INTO ${bead_dependencies} (
-        ${bead_dependencies.columns.bead_id},
-        ${bead_dependencies.columns.depends_on_bead_id},
-        ${bead_dependencies.columns.dependency_type}
-      ) VALUES (?, ?, 'tracks')
+      INSERT INTO ${review_metadata} (
+        ${review_metadata.columns.bead_id}, ${review_metadata.columns.branch},
+        ${review_metadata.columns.target_branch}, ${review_metadata.columns.merge_commit},
+        ${review_metadata.columns.pr_url}, ${review_metadata.columns.retry_count}
+      ) VALUES (?, ?, ?, ?, ?, ?)
     `,
-    [id, input.bead_id]
+    [id, args.branch, args.targetBranch, null, args.prUrl ?? null, 0]
   );
 
-  // Create the review_metadata satellite
+  return { beadId: id };
+}
+
+export function submitToReviewQueue(sql: SqlStorage, input: ReviewQueueInput): void {
+  const metadata: Record<string, unknown> = {
+    source_bead_id: input.bead_id,
+    source_agent_id: input.agent_id,
+  };
+  if (input.pr_url) {
+    metadata.pr_url = input.pr_url;
+  }
+
+  const convoyId = getConvoyForBead(sql, input.bead_id);
+  const convoyFeatureBranch = convoyId ? getConvoyFeatureBranch(sql, convoyId) : null;
+  const convoyMergeMode = convoyId ? getConvoyMergeMode(sql, convoyId) : null;
+  const targetBranch =
+    convoyMergeMode === 'review-then-land' && convoyFeatureBranch
+      ? convoyFeatureBranch
+      : (input.default_branch ?? 'main');
+
+  if (convoyId) {
+    metadata.convoy_id = convoyId;
+    if (convoyFeatureBranch) {
+      metadata.convoy_feature_branch = convoyFeatureBranch;
+    }
+  }
+
+  const { beadId } = createMergeRequestBeadCore(sql, {
+    rigId: input.rig_id,
+    title: `Review: ${input.branch}`,
+    body: input.summary ?? null,
+    metadata,
+    labels: ['gt:merge-request'],
+    createdBy: input.agent_id,
+    branch: input.branch,
+    targetBranch,
+    prUrl: input.pr_url,
+  });
+
   query(
     sql,
     /* sql */ `
-      INSERT INTO ${review_metadata} (
-        ${review_metadata.columns.bead_id}, ${review_metadata.columns.branch},
-        ${review_metadata.columns.target_branch}, ${review_metadata.columns.merge_commit},
-        ${review_metadata.columns.pr_url}, ${review_metadata.columns.retry_count}
-      ) VALUES (?, ?, ?, ?, ?, ?)
+      INSERT INTO ${bead_dependencies} (
+        ${bead_dependencies.columns.bead_id},
+        ${bead_dependencies.columns.depends_on_bead_id},
+        ${bead_dependencies.columns.dependency_type}
+      ) VALUES (?, ?, 'tracks')
     `,
-    [id, input.branch, targetBranch, null, input.pr_url ?? null, 0]
+    [beadId, input.bead_id]
   );
 
   logBeadEvent(sql, {
@@ -208,6 +228,56 @@ export function submitToReviewQueue(sql: SqlStorage, input: ReviewQueueInput): v
   });
 }
 
+export function submitExternalPrToReviewQueue(
+  sql: SqlStorage,
+  args: {
+    rigId: string;
+    prUrl: string;
+    branch: string;
+    targetBranch: string;
+    headSha: string;
+    title: string;
+    body?: string;
+    forcePushAllowed: boolean;
+    sourceAgentId: string;
+  }
+): { beadId: string } {
+  const metadata: Record<string, unknown> = {
+    source_agent_id: args.sourceAgentId,
+    babysit: true,
+    head_sha: args.headSha,
+    force_push_allowed: args.forcePushAllowed,
+    babysit_started_at: new Date().toISOString(),
+  };
+
+  const { beadId } = createMergeRequestBeadCore(sql, {
+    rigId: args.rigId,
+    title: args.title,
+    body: args.body ?? null,
+    metadata,
+    labels: ['gt:merge-request', 'gt:babysit'],
+    createdBy: args.sourceAgentId,
+    branch: args.branch,
+    targetBranch: args.targetBranch,
+    prUrl: args.prUrl,
+  });
+
+  logBeadEvent(sql, {
+    beadId,
+    agentId: args.sourceAgentId,
+    eventType: 'babysit_started',
+    newValue: args.prUrl,
+    metadata: {
+      branch: args.branch,
+      target_branch: args.targetBranch,
+      head_sha: args.headSha,
+      pr_url: args.prUrl,
+    },
+  });
+
+  return { beadId };
+}
+
 export function completeReview(
   sql: SqlStorage,
   entryId: string,
@@ -735,23 +805,30 @@ export function agentCompleted(
         });
       } else if (hookedBead && hookedBead.status === 'in_progress') {
         if (input.reason === 'container eviction') {
-          // Container eviction: WIP was force-pushed and eviction context
-          // was written on the bead body. Reset to open and clear the
-          // stale assignee so the reconciler can re-dispatch immediately.
-          console.log(
-            `[review-queue] agentCompleted: polecat ${agentId} evicted — ` +
-              `resetting bead ${agent.current_hook_bead_id} to open`
-          );
-          updateBeadStatus(sql, agent.current_hook_bead_id, 'open', agentId);
-          query(
-            sql,
-            /* sql */ `
-              UPDATE ${beads}
-              SET ${beads.columns.assignee_agent_bead_id} = NULL
-              WHERE ${beads.bead_id} = ?
-            `,
-            [agent.current_hook_bead_id]
-          );
+          if (!heartbeatStale(agent.last_activity_at)) {
+            console.log(
+              `[review-queue] agentCompleted: polecat ${agentId} eviction event ignored — ` +
+                `heartbeat fresh; bead ${agent.current_hook_bead_id} stays in_progress`
+            );
+          } else {
+            // Container eviction with a stale heartbeat: WIP was force-pushed and eviction
+            // context was written on the bead body. Reset to open and clear the stale
+            // assignee so the reconciler can re-dispatch immediately.
+            console.log(
+              `[review-queue] agentCompleted: polecat ${agentId} evicted (heartbeat stale) — ` +
+                `resetting bead ${agent.current_hook_bead_id} to open`
+            );
+            updateBeadStatus(sql, agent.current_hook_bead_id, 'open', agentId);
+            query(
+              sql,
+              /* sql */ `
+                UPDATE ${beads}
+                SET ${beads.columns.assignee_agent_bead_id} = NULL
+                WHERE ${beads.bead_id} = ?
+              `,
+              [agent.current_hook_bead_id]
+            );
+          }
         } else {
           // Agent exited 'completed' but bead is still in_progress — gt_done was never called.
           // Don't close the bead. Rule 3 will handle rework.
@@ -1177,7 +1254,8 @@ export function getMergeQueueData(sql: SqlStorage, params: MergeQueueParams): Me
           ON rig.id = b.${beads.columns.rig_id}
         WHERE ${bead_events.event_type} IN (
           'review_submitted', 'review_completed', 'pr_created',
-          'pr_creation_failed', 'rework_requested', 'status_changed'
+          'pr_creation_failed', 'rework_requested', 'status_changed',
+          'babysit_started'
         )
           AND (? IS NULL OR b.${beads.columns.rig_id} = ?)
           AND (? IS NULL OR ${bead_events.created_at} > ?)
diff --git a/services/gastown/src/dos/town/staleness.test.ts b/services/gastown/src/dos/town/staleness.test.ts
new file mode 100644
index 0000000000..451b9f220c
--- /dev/null
+++ b/services/gastown/src/dos/town/staleness.test.ts
@@ -0,0 +1,30 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { HEARTBEAT_STALE_MS, heartbeatStale } from './staleness';
+
+describe('heartbeatStale', () => {
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('treats a fresh heartbeat as live', () => {
+    vi.useFakeTimers();
+    const now = new Date('2026-05-28T12:00:00.000Z');
+    vi.setSystemTime(now);
+
+    expect(heartbeatStale(new Date(now.getTime() - 1_000).toISOString())).toBe(false);
+  });
+
+  it('treats a heartbeat past the threshold as stale', () => {
+    vi.useFakeTimers();
+    const now = new Date('2026-05-28T12:00:00.000Z');
+    vi.setSystemTime(now);
+
+    expect(heartbeatStale(new Date(now.getTime() - HEARTBEAT_STALE_MS - 1).toISOString())).toBe(
+      true
+    );
+  });
+
+  it('treats a missing heartbeat as stale', () => {
+    expect(heartbeatStale(null)).toBe(true);
+  });
+});
diff --git a/services/gastown/src/dos/town/staleness.ts b/services/gastown/src/dos/town/staleness.ts
new file mode 100644
index 0000000000..6fb5fb1a1c
--- /dev/null
+++ b/services/gastown/src/dos/town/staleness.ts
@@ -0,0 +1,10 @@
+export const HEARTBEAT_STALE_MS = 90_000;
+
+export function staleMs(timestamp: string | null, thresholdMs: number): boolean {
+  if (!timestamp) return true;
+  return Date.now() - new Date(timestamp).getTime() > thresholdMs;
+}
+
+export function heartbeatStale(timestamp: string | null): boolean {
+  return staleMs(timestamp, HEARTBEAT_STALE_MS);
+}
diff --git a/services/gastown/src/dos/town/town-scm.ts b/services/gastown/src/dos/town/town-scm.ts
index a077d713d3..e83cb3b130 100644
--- a/services/gastown/src/dos/town/town-scm.ts
+++ b/services/gastown/src/dos/town/town-scm.ts
@@ -108,6 +108,10 @@ export async function resolveGitHubTokenString(ctx: SCMContext): Promise<string
 export type PRStatusResult = {
   status: 'open' | 'merged' | 'closed';
   mergeable_state?: string;
+  head_branch?: string;
+  base_branch?: string;
+  head_sha?: string;
+  title?: string;
 };
 
 export type PRStatusError =
@@ -203,9 +207,39 @@ export async function checkPRStatus(ctx: SCMContext, prUrl: string): Promise<PRS
       };
     }
 
-    if (data.data.merged) return { ok: true, result: { status: 'merged' } };
-    if (data.data.state === 'closed') return { ok: true, result: { status: 'closed' } };
-    return { ok: true, result: { status: 'open', mergeable_state: data.data.mergeable_state } };
+    if (data.data.merged)
+      return {
+        ok: true,
+        result: {
+          status: 'merged',
+          head_branch: data.data.head?.ref,
+          base_branch: data.data.base?.ref,
+          head_sha: data.data.head?.sha,
+          title: data.data.title,
+        },
+      };
+    if (data.data.state === 'closed')
+      return {
+        ok: true,
+        result: {
+          status: 'closed',
+          head_branch: data.data.head?.ref,
+          base_branch: data.data.base?.ref,
+          head_sha: data.data.head?.sha,
+          title: data.data.title,
+        },
+      };
+    return {
+      ok: true,
+      result: {
+        status: 'open',
+        mergeable_state: data.data.mergeable_state,
+        head_branch: data.data.head?.ref,
+        base_branch: data.data.base?.ref,
+        head_sha: data.data.head?.sha,
+        title: data.data.title,
+      },
+    };
   }
 
   // GitLab MR URL format: https://{host}/{path}/-/merge_requests/{iid}
@@ -288,9 +322,38 @@ export async function checkPRStatus(ctx: SCMContext, prUrl: string): Promise<PRS
       };
     }
 
-    if (data.data.state === 'merged') return { ok: true, result: { status: 'merged' } };
-    if (data.data.state === 'closed') return { ok: true, result: { status: 'closed' } };
-    return { ok: true, result: { status: 'open' } };
+    if (data.data.state === 'merged')
+      return {
+        ok: true,
+        result: {
+          status: 'merged',
+          head_branch: data.data.source_branch,
+          base_branch: data.data.target_branch,
+          head_sha: data.data.sha,
+          title: data.data.title,
+        },
+      };
+    if (data.data.state === 'closed')
+      return {
+        ok: true,
+        result: {
+          status: 'closed',
+          head_branch: data.data.source_branch,
+          base_branch: data.data.target_branch,
+          head_sha: data.data.sha,
+          title: data.data.title,
+        },
+      };
+    return {
+      ok: true,
+      result: {
+        status: 'open',
+        head_branch: data.data.source_branch,
+        base_branch: data.data.target_branch,
+        head_sha: data.data.sha,
+        title: data.data.title,
+      },
+    };
   }
 
   console.warn(`${TOWN_LOG} checkPRStatus: unrecognized PR URL format: ${prUrl}`);
diff --git a/services/gastown/src/gastown.worker.ts b/services/gastown/src/gastown.worker.ts
index 9760500ba1..198196aabb 100644
--- a/services/gastown/src/gastown.worker.ts
+++ b/services/gastown/src/gastown.worker.ts
@@ -105,6 +105,7 @@ import {
 import {
   handleMayorSling,
   handleMayorSlingBatch,
+  handleMayorBabysitPr,
   handleMayorListRigs,
   handleMayorListBeads,
   handleMayorListAgents,
@@ -1201,6 +1202,11 @@ app.get('/api/mayor/:townId/tools/rigs/:rigId/agents/:agentId/pending-nudges', c
 app.post('/api/mayor/:townId/tools/sling', c =>
   instrumented(c, 'POST /api/mayor/:townId/tools/sling', () => handleMayorSling(c, c.req.param()))
 );
+app.post('/api/mayor/:townId/tools/babysit-pr', c =>
+  instrumented(c, 'POST /api/mayor/:townId/tools/babysit-pr', () =>
+    handleMayorBabysitPr(c, c.req.param())
+  )
+);
 app.post('/api/mayor/:townId/tools/sling-batch', c =>
   instrumented(c, 'POST /api/mayor/:townId/tools/sling-batch', () =>
     handleMayorSlingBatch(c, c.req.param())
diff --git a/services/gastown/src/handlers/mayor-tools.handler.ts b/services/gastown/src/handlers/mayor-tools.handler.ts
index 6bc22f0f9b..e18e6a2c97 100644
--- a/services/gastown/src/handlers/mayor-tools.handler.ts
+++ b/services/gastown/src/handlers/mayor-tools.handler.ts
@@ -27,6 +27,14 @@ const MayorSlingBody = z.object({
   labels: z.array(z.string()).optional(),
 });
 
+const MayorBabysitPrBody = z.object({
+  rig_id: z.string().min(1),
+  pr_url: z.string().url(),
+  title: z.string().optional(),
+  body: z.string().optional(),
+  force_push_allowed: z.boolean().optional(),
+});
+
 const MayorSlingBatchBody = z
   .object({
     rig_id: z.string().min(1),
@@ -165,6 +173,45 @@ export async function handleMayorSling(c: Context<GastownEnv>, params: { townId:
   return c.json(resSuccess(result), 201);
 }
 
+/**
+ * POST /api/mayor/:townId/tools/babysit-pr
+ * Adopt an existing PR for the town to babysit. Creates a merge_request
+ * bead with babysit metadata, bypasses refinery code review, and starts
+ * polling the PR for feedback/conflicts/auto-merge.
+ */
+export async function handleMayorBabysitPr(c: Context<GastownEnv>, params: { townId: string }) {
+  const parsed = MayorBabysitPrBody.safeParse(await parseJsonBody(c));
+  if (!parsed.success) {
+    return c.json(
+      { success: false, error: 'Invalid request body', issues: parsed.error.issues },
+      400
+    );
+  }
+
+  const rigOwned = await verifyRigBelongsToTown(c, params.townId, parsed.data.rig_id);
+  if (!rigOwned) {
+    return c.json(resError('Rig not found in this town'), 403);
+  }
+
+  console.log(
+    `${HANDLER_LOG} handleMayorBabysitPr: townId=${params.townId} rigId=${parsed.data.rig_id} prUrl=${parsed.data.pr_url}`
+  );
+
+  const town = getTownDOStub(c.env, params.townId);
+  const result = await town.slingExistingPr({
+    rigId: parsed.data.rig_id,
+    prUrl: parsed.data.pr_url,
+    title: parsed.data.title,
+    body: parsed.data.body,
+    forcePushAllowed: parsed.data.force_push_allowed,
+    sourceAgentId: 'mayor',
+  });
+
+  console.log(`${HANDLER_LOG} handleMayorBabysitPr: completed, beadId=${result.beadId}`);
+
+  return c.json(resSuccess(result), 201);
+}
+
 /**
  * GET /api/mayor/:townId/tools/rigs
  * List all rigs in the town. Requires userId to route to the correct
diff --git a/services/gastown/src/prompts/mayor-system.prompt.ts b/services/gastown/src/prompts/mayor-system.prompt.ts
index 054ef037a8..ce68dd7e3f 100644
--- a/services/gastown/src/prompts/mayor-system.prompt.ts
+++ b/services/gastown/src/prompts/mayor-system.prompt.ts
@@ -38,6 +38,7 @@ You have these tools for cross-rig coordination:
 - **gt_convoy_status** — Show detailed status of a convoy: each tracked bead with its status and assignee. Use for progress reports.
 - **gt_mail_send** — Send a message to any agent in any rig. Use for coordination, follow-up instructions, or status checks.
 - **gt_ui_action** — Trigger a UI action in the user's dashboard (open drawers, navigate pages, trigger dialogs). See the UI Control section below.
+- **gt_babysit_pr** — Adopt an existing PR for the town to babysit. The town polls the PR, addresses feedback, fixes conflicts, and auto-merges. Use when the user wants the town to take over an existing PR rather than create new work. See the Babysit Existing PR section below.
 
 ## Task Decomposition — USE CONVOYS
 
@@ -304,6 +305,33 @@ When you need to dispatch a polecat to fix PR review comments or CI failures on
 
 The \`gt:pr-fixup\` label causes the bead to skip the review queue when the polecat calls gt_done — the work goes directly to the existing PR branch without creating a separate review cycle.
 
+## Babysit Existing PR
+
+When the user wants the town to take over an existing PR — one they created manually, one from another tool, or one from a third party they have rights to — use \`gt_babysit_pr\` instead of \`gt_sling\`.
+
+**gt_sling vs gt_babysit_pr:**
+- **gt_sling**: Creates a feature bead → polecat does the work → opens a PR.
+- **gt_babysit_pr**: Adopts an existing PR → town polls it, addresses feedback, fixes conflicts, auto-merges.
+
+**Example phrasings the user might use:**
+- "babysit this PR"
+- "watch over PR #123"
+- "take over this PR"
+- "address comments on this PR"
+- "merge this PR for me"
+- "finish this PR"
+
+When you recognize any of these patterns, call \`gt_babysit_pr\` with the PR URL and rig ID.
+
+**The \`force_push_allowed\` parameter:**
+
+Default \`false\`. Controls whether polecats can force-push to the PR branch when fixing conflicts or addressing review comments.
+
+- If the PR was authored by the user themselves, ask them whether the town can force-push. Rebase + force-push is the cleanest way to fix conflicts, but it rewrites history.
+- If the PR was authored by someone else (third party, another tool), keep the default \`false\`. The polecat will use merge commits and regular pushes only — never rewriting history.
+
+**Important caveat**: Babysat PRs bypass refinery code review. The user is opting into "merge this PR", not "review this PR". If they want the town to review the code first, that's a different flow (not cleanly supported today — flag this as a future improvement).
+
 ## Bug Reporting
 
 If a user reports a bug or you encounter a repeating error, you can file a bug report
diff --git a/services/gastown/src/prompts/polecat-system.prompt.ts b/services/gastown/src/prompts/polecat-system.prompt.ts
index d9ca8e9efd..0f3194367c 100644
--- a/services/gastown/src/prompts/polecat-system.prompt.ts
+++ b/services/gastown/src/prompts/polecat-system.prompt.ts
@@ -82,28 +82,44 @@ After all gates pass and your work is complete, create a pull request before cal
 `
       : ''
   }
+## Force-push policy
+
+When handling a gt:pr-fixup, gt:pr-feedback, or gt:pr-conflict bead, check \`force_push_allowed\` in your prime context (it comes from \`bead.metadata.force_push_allowed\`):
+
+- If \`force_push_allowed === true\` **or absent** (backwards compat for beads created before this gate landed), use \`git push --force-with-lease\` for rebase-style fixes. Cleaner history.
+
+- If \`force_push_allowed === false\` (set on babysat PRs where the user has not authorized force-push), DO NOT force-push. Instead:
+  - For conflicts: \`git merge origin/<target_branch>\` (creates a merge commit; preserves history)
+  - For fixups/feedback: regular \`git commit && git push\`
+  - Push only fast-forwarding commits — never rewrite history.
+
+This field is surfaced in the prime context as \`pr_fixup_context.force_push_allowed\` or \`pr_conflict_context.force_push_allowed\`. When absent (non-babysat beads), treat it as \`true\`.
+
 ## PR Conflict Resolution Workflow
 
 When your hooked bead has the \`gt:pr-conflict\` label, **or** when it has the \`gt:pr-feedback\` label and \`pr_conflict_context\` is present in your context, you are resolving merge conflicts on an existing PR branch. **This is an exception to the "do not switch branches" rule.** You MUST check out the PR branch from your bead metadata (\`pr_conflict_context.branch\`).
 
-1. Check out the PR branch: \`git fetch origin && git checkout <branch>\`
-2. Rebase onto the target branch to incorporate its latest changes:
-   \`\`\`
-   git rebase origin/<target_branch>
-   \`\`\`
-3. If there are conflicts during rebase, resolve them:
-   - Edit conflicting files to resolve conflict markers (\`<<<<<<<\`, \`=======\`, \`>>>>>>>\`)
-   - Stage the resolved files: \`git add <file>\`
-   - Continue the rebase: \`git rebase --continue\`
-   - Repeat until the rebase completes
-4. Push the rebased branch:
-   \`\`\`
-   git push --force-with-lease origin <branch>
-   \`\`\`
-5. If the bead metadata has \`has_feedback: true\`, also address the PR review feedback (see PR Fixup Workflow below) before calling gt_done.
- 6. Call \`gt_done\` with both required arguments once all conflicts are resolved (and feedback addressed if applicable):
-    - \`pr_url\`: the PR URL from \`pr_conflict_context.pr_url\`
-    - \`branch\`: the branch name from \`pr_conflict_context.branch\`
+**Before starting any conflict resolution**, check \`force_push_allowed\` in your prime context to decide the strategy:
+
+- **If \`force_push_allowed === true\` or absent** → use **rebase** (rewrites history, cleaner):
+  1. Check out the PR branch: \`git fetch origin && git checkout <branch>\`
+  2. Rebase onto the target branch: \`git rebase origin/<target_branch>\`
+  3. Resolve any conflicts: edit files, \`git add\`, \`git rebase --continue\`
+  4. Push: \`git push --force-with-lease origin <branch>\`
+
+- **If \`force_push_allowed === false\`** → use **merge** (preserves history, no force-push):
+  1. Check out the PR branch: \`git fetch origin && git checkout <branch>\`
+  2. Merge the target branch: \`git merge origin/<target_branch>\`
+  3. Resolve any conflicts: edit files, \`git add\`, \`git commit\`
+  4. Push: \`git push origin <branch>\`
+
+Do NOT start a rebase and then abort it — choose the right strategy first.
+
+If the bead metadata has \`has_feedback: true\`, also address the PR review feedback (see PR Fixup Workflow below) before calling gt_done.
+
+Call \`gt_done\` with both required arguments once all conflicts are resolved (and feedback addressed if applicable):
+  - \`pr_url\`: the PR URL from \`pr_conflict_context.pr_url\`
+  - \`branch\`: the branch name from \`pr_conflict_context.branch\`
 
 Do NOT create a new PR. Push to the existing branch.
 
@@ -117,7 +133,7 @@ When your hooked bead has the \`gt:pr-fixup\` label, you are fixing an existing
    - If the comment is actionable: fix the issue, push the fix, reply explaining how you fixed it, and resolve the thread.
    - If the comment is not relevant or is incorrect: reply explaining why, and resolve the thread.
 4. **Important**: Resolve the entire thread, not just the individual comment. Use \`gh api\` to resolve review threads.
-5. After addressing all comments, push your changes and call gt_done.
+5. After addressing all comments, push your changes following the **Force-push policy** above and call gt_done.
 
 Do NOT create a new PR. Push to the existing branch.
 
diff --git a/services/gastown/src/trpc/router.ts b/services/gastown/src/trpc/router.ts
index 3d0427762e..5a5efa646b 100644
--- a/services/gastown/src/trpc/router.ts
+++ b/services/gastown/src/trpc/router.ts
@@ -16,6 +16,7 @@ import { getGastownOrgStub } from '../dos/GastownOrg.do';
 import type { JwtOrgMembership } from '../middleware/auth.middleware';
 import { generateKiloApiToken } from '../util/kilo-token.util';
 import { resolveSecret } from '../util/secret.util';
+import { writeEvent } from '../util/analytics.util';
 import { TownConfigSchema, TownConfigUpdateSchema, RigOverrideConfigSchema } from '../types';
 import { resolveModel } from '../dos/town/config';
 import type { UserRigRecord } from '../db/tables/user-rigs.table';
@@ -30,6 +31,8 @@ import {
   RpcStreamTicketOutput,
   RpcPtySessionOutput,
   RpcSlingResultOutput,
+  RpcBabysitPrResultOutput,
+  RpcPreviewPrResultOutput,
   RpcRigDetailOutput,
   RpcConvoyDetailOutput,
   RpcAlarmStatusOutput,
@@ -76,6 +79,46 @@ async function refreshGitCredentials(
   });
 }
 
+async function refreshFirstGithubRigCredentials(params: {
+  env: Env;
+  townId: string;
+  ownerStub: RigOwnerStub;
+  credentialUserId: string;
+  organizationId?: string;
+}): Promise<void> {
+  const start = Date.now();
+  try {
+    const rigList = await params.ownerStub.listRigs(params.townId);
+    for (const rig of rigList) {
+      if (extractGithubRepo(rig.git_url)) {
+        await refreshGitCredentials(
+          params.env,
+          params.townId,
+          rig.git_url,
+          params.credentialUserId,
+          params.organizationId
+        );
+        break;
+      }
+    }
+    writeEvent(params.env, {
+      event: 'ensureMayor.git_credential_refresh_ms',
+      townId: params.townId,
+      userId: params.credentialUserId,
+      durationMs: Date.now() - start,
+    });
+  } catch (err) {
+    writeEvent(params.env, {
+      event: 'ensureMayor.git_credential_refresh_ms',
+      townId: params.townId,
+      userId: params.credentialUserId,
+      durationMs: Date.now() - start,
+      error: err instanceof Error ? err.message : String(err),
+    });
+    console.warn('[gastown-trpc] ensureMayor: git credential refresh failed', err);
+  }
+}
+
 // ── Helpers ────────────────────────────────────────────────────────────
 
 /** Extract user identity fields from the tRPC context. */
@@ -850,6 +893,47 @@ export const gastownRouter = router({
       });
     }),
 
+  babysitPr: gastownProcedure
+    .input(
+      z.object({
+        rigId: z.string().uuid(),
+        prUrl: z.string().url(),
+        title: z.string().optional(),
+        body: z.string().optional(),
+        forcePushAllowed: z.boolean().optional(),
+      })
+    )
+    .output(RpcBabysitPrResultOutput)
+    .mutation(async ({ ctx, input }) => {
+      const rig = await verifyRigOwnership(ctx.env, ctx, input.rigId);
+      const townStub = getTownDOStub(ctx.env, rig.town_id);
+      return townStub.slingExistingPr({
+        rigId: rig.id,
+        prUrl: input.prUrl,
+        title: input.title,
+        body: input.body,
+        forcePushAllowed: input.forcePushAllowed,
+        sourceAgentId: 'system',
+      });
+    }),
+
+  previewPr: gastownProcedure
+    .input(
+      z.object({
+        rigId: z.string().uuid(),
+        prUrl: z.string().url(),
+      })
+    )
+    .output(RpcPreviewPrResultOutput)
+    .query(async ({ ctx, input }) => {
+      const rig = await verifyRigOwnership(ctx.env, ctx, input.rigId);
+      const townStub = getTownDOStub(ctx.env, rig.town_id);
+      return townStub.previewPr({
+        rigId: rig.id,
+        prUrl: input.prUrl,
+      });
+    }),
+
   createBead: gastownProcedure
     .input(
       z.object({
@@ -1004,23 +1088,15 @@ export const gastownRouter = router({
       // Best-effort: refresh git credentials using the town owner's identity
       const townConfig = await getTownDOStub(ctx.env, input.townId).getTownConfig();
       const credentialUserId = townConfig.owner_user_id ?? ctx.userId;
-      try {
-        const rigList = await ownerStub.listRigs(input.townId);
-        for (const rig of rigList) {
-          if (extractGithubRepo(rig.git_url)) {
-            await refreshGitCredentials(
-              ctx.env,
-              input.townId,
-              rig.git_url,
-              credentialUserId,
-              townConfig.organization_id
-            );
-            break;
-          }
-        }
-      } catch (err) {
-        console.warn('[gastown-trpc] ensureMayor: git credential refresh failed', err);
-      }
+      ctx.executionCtx.waitUntil(
+        refreshFirstGithubRigCredentials({
+          env: ctx.env,
+          townId: input.townId,
+          ownerStub,
+          credentialUserId,
+          organizationId: townConfig.organization_id,
+        })
+      );
 
       const townStub = getTownDOStub(ctx.env, input.townId);
       return townStub.ensureMayor();
diff --git a/services/gastown/src/trpc/schemas.ts b/services/gastown/src/trpc/schemas.ts
index e204f3b1bf..d23849f8cf 100644
--- a/services/gastown/src/trpc/schemas.ts
+++ b/services/gastown/src/trpc/schemas.ts
@@ -155,6 +155,22 @@ export const SlingResultOutput = z.object({
   agent: AgentOutput,
 });
 
+// BabysitPrResult
+export const BabysitPrResultOutput = z.object({
+  beadId: z.string(),
+  warning: z.string().optional(),
+});
+
+// PreviewPrResult
+export const PreviewPrResultOutput = z.object({
+  state: z.string(),
+  head_branch: z.string().optional(),
+  base_branch: z.string().optional(),
+  head_sha: z.string().optional(),
+  title: z.string().optional(),
+  repo_matches: z.boolean(),
+});
+
 // getRig enriched result
 export const RigDetailOutput = z.object({
   id: z.string(),
@@ -189,6 +205,8 @@ export const RpcPtySessionOutput = rpcSafe(PtySessionOutput);
 export const RpcConvoyOutput = rpcSafe(ConvoyOutput);
 export const RpcConvoyDetailOutput = rpcSafe(ConvoyDetailOutput);
 export const RpcSlingResultOutput = rpcSafe(SlingResultOutput);
+export const RpcBabysitPrResultOutput = rpcSafe(BabysitPrResultOutput);
+export const RpcPreviewPrResultOutput = rpcSafe(PreviewPrResultOutput);
 
 // Alarm status
 const AlarmStatusOutput = z.object({
diff --git a/services/gastown/src/types.ts b/services/gastown/src/types.ts
index 01635ddcfa..a73d9c82f6 100644
--- a/services/gastown/src/types.ts
+++ b/services/gastown/src/types.ts
@@ -176,6 +176,8 @@ export type PrimeContext = {
     pr_url: string | null;
     branch: string | null;
     target_branch: string | null;
+    /** Whether force-push is allowed on this PR branch. Absent on pre-babysit beads = true (backwards compat). */
+    force_push_allowed: boolean;
   } | null;
   /** Present when the hooked bead is a PR conflict resolution (gt:pr-conflict label). */
   pr_conflict_context: {
@@ -184,6 +186,8 @@ export type PrimeContext = {
     target_branch: string | null;
     /** When true, the bead also has pending review feedback to address after resolving conflicts. */
     has_feedback: boolean;
+    /** Whether force-push is allowed on this PR branch. Absent on pre-babysit beads = true (backwards compat). */
+    force_push_allowed: boolean;
   } | null;
 };
 
diff --git a/services/gastown/src/util/platform-pr.util.ts b/services/gastown/src/util/platform-pr.util.ts
index f0310321c4..dc6bb713a0 100644
--- a/services/gastown/src/util/platform-pr.util.ts
+++ b/services/gastown/src/util/platform-pr.util.ts
@@ -88,12 +88,28 @@ export const GitHubPRStatusSchema = z.object({
   state: z.string(),
   merged: z.boolean().optional(),
   mergeable: z.boolean().nullable().optional(),
-  mergeable_state: z.string().optional(), // 'clean', 'dirty', 'blocked', 'unknown', 'unstable'
+  mergeable_state: z.string().optional(),
+  head: z
+    .object({
+      ref: z.string().optional(),
+      sha: z.string().optional(),
+    })
+    .optional(),
+  base: z
+    .object({
+      ref: z.string().optional(),
+    })
+    .optional(),
+  title: z.string().optional(),
 });
 
 /** Schema for GitLab MR status responses (used by checkPRStatus). */
 export const GitLabMRStatusSchema = z.object({
   state: z.string(),
+  source_branch: z.string().optional(),
+  target_branch: z.string().optional(),
+  sha: z.string().optional(),
+  title: z.string().optional(),
 });
 
 // -- GitHub PR creation --
diff --git a/services/gastown/test/integration/reconciler.test.ts b/services/gastown/test/integration/reconciler.test.ts
index e5e2869245..72c1633f6b 100644
--- a/services/gastown/test/integration/reconciler.test.ts
+++ b/services/gastown/test/integration/reconciler.test.ts
@@ -126,7 +126,7 @@ describe('Reconciler', () => {
     });
   });
 
-  // ── #1358: Heartbeat restores working status ────────────────────────
+  // ── #1358: Container activity restores working status ───────────────
 
   describe('#1358: dispatch timeout race recovery', () => {
     it('should restore idle agent to working on heartbeat', async () => {
@@ -195,6 +195,52 @@ describe('Reconciler', () => {
       const after = await town.getAgentAsync(agent.id);
       expect(after?.status).toBe('exited');
     });
+
+    it('should restore idle agent to working on agent event activity', async () => {
+      const agent = await town.registerAgent({
+        role: 'polecat',
+        name: 'P4',
+        identity: `agent-event-restore-${townName}`,
+        rig_id: 'rig-1',
+      });
+      const bead = await town.createBead({
+        type: 'issue',
+        title: 'Agent event activity test',
+        rig_id: 'rig-1',
+      });
+
+      await town.hookBead(agent.id, bead.bead_id);
+      await town.updateAgentStatus(agent.id, 'idle');
+
+      await town.appendAgentEvent(agent.id, 'message', { text: 'working' });
+
+      const after = await town.getAgentAsync(agent.id);
+      expect(after?.status).toBe('working');
+      expect(after?.last_activity_at).toBeTruthy();
+    });
+
+    it('should restore idle agent to working on status message activity', async () => {
+      const agent = await town.registerAgent({
+        role: 'polecat',
+        name: 'P5',
+        identity: `status-message-restore-${townName}`,
+        rig_id: 'rig-1',
+      });
+      const bead = await town.createBead({
+        type: 'issue',
+        title: 'Status message activity test',
+        rig_id: 'rig-1',
+      });
+
+      await town.hookBead(agent.id, bead.bead_id);
+      await town.updateAgentStatus(agent.id, 'idle');
+
+      await town.updateAgentStatusMessage(agent.id, 'Still working');
+
+      const after = await town.getAgentAsync(agent.id);
+      expect(after?.status).toBe('working');
+      expect(after?.last_activity_at).toBeTruthy();
+    });
   });
 
   // ── Event-driven agentDone ──────────────────────────────────────────
@@ -237,6 +283,38 @@ describe('Reconciler', () => {
     });
   });
 
+  describe('event-driven agentCompleted container eviction', () => {
+    it('keeps an in-progress bead assigned when the agent heartbeat is fresh', async () => {
+      const agent = await town.registerAgent({
+        role: 'polecat',
+        name: 'P1',
+        identity: `eviction-fresh-${townName}`,
+        rig_id: 'rig-1',
+      });
+      const bead = await town.createBead({
+        type: 'issue',
+        title: 'Fresh eviction bead',
+        rig_id: 'rig-1',
+      });
+
+      await town.hookBead(agent.id, bead.bead_id);
+      await town.updateBeadStatus(bead.bead_id, 'in_progress', agent.id);
+      await town.updateAgentStatus(agent.id, 'working');
+      await town.touchAgentHeartbeat(agent.id);
+
+      await town.agentCompleted(agent.id, { status: 'completed', reason: 'container eviction' });
+      await runDurableObjectAlarm(town);
+
+      const beadAfter = await town.getBeadAsync(bead.bead_id);
+      expect(beadAfter?.status).toBe('in_progress');
+      expect(beadAfter?.assignee_agent_bead_id).toBe(agent.id);
+
+      const agentAfter = await town.getAgentAsync(agent.id);
+      expect(agentAfter?.status).toBe('idle');
+      expect(agentAfter?.current_hook_bead_id).toBeNull();
+    });
+  });
+
   // ── reconcileReviewQueue Rule 5: Refinery dispatch ──────────────────
 
   describe('reconcileReviewQueue Rule 5: refinery dispatch', () => {
diff --git a/services/gastown/test/unit/babysit-pr-helpers.ts b/services/gastown/test/unit/babysit-pr-helpers.ts
new file mode 100644
index 0000000000..44e81238b5
--- /dev/null
+++ b/services/gastown/test/unit/babysit-pr-helpers.ts
@@ -0,0 +1,395 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { checkPRStatus, type SCMContext } from '../../src/dos/town/town-scm';
+import { parseGitUrl } from '../../src/util/platform-pr.util';
+import type { TownConfig } from '../../src/types';
+
+export function mockSCMContext(overrides: Partial<SCMContext> = {}): SCMContext {
+  return {
+    env: {} as SCMContext['env'],
+    townId: 'test-town',
+    getTownConfig: async () => ({}) as TownConfig,
+    ...overrides,
+  };
+}
+
+export const GITHUB_OPEN_PR = {
+  state: 'open',
+  merged: false,
+  mergeable_state: 'clean',
+  head: { ref: 'feature/babysit', sha: 'abc1234def5678' },
+  base: { ref: 'main' },
+  title: 'Add babysit PR feature',
+};
+
+export const GITHUB_MERGED_PR = {
+  state: 'closed',
+  merged: true,
+  mergeable_state: 'clean',
+  head: { ref: 'feature/merged', sha: 'mergedsha123' },
+  base: { ref: 'main' },
+  title: 'Already merged PR',
+};
+
+export const GITHUB_CLOSED_PR = {
+  state: 'closed',
+  merged: false,
+  head: { ref: 'feature/closed', sha: 'closedsha123' },
+  base: { ref: 'main' },
+  title: 'Closed PR',
+};
+
+export const GITLAB_OPEN_MR = {
+  state: 'opened',
+  source_branch: 'feature/babysit',
+  target_branch: 'main',
+  sha: 'glabc1234def',
+  title: 'Add babysit MR feature',
+};
+
+export const GITLAB_MERGED_MR = {
+  state: 'merged',
+  source_branch: 'feature/merged',
+  target_branch: 'main',
+  sha: 'glmergedsha',
+  title: 'Already merged MR',
+};
+
+export const GITLAB_CLOSED_MR = {
+  state: 'closed',
+  source_branch: 'feature/closed',
+  target_branch: 'main',
+  sha: 'glclosedsha',
+  title: 'Closed MR',
+};
+
+export function registerCheckPRStatusTests() {
+  describe('checkPRStatus extended fields (head_branch, base_branch, head_sha, title)', () => {
+    beforeEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    it('returns head_branch, base_branch, head_sha, title for open GitHub PR', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITHUB_OPEN_PR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { github_token: 'ghp_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('open');
+        expect(outcome.result.head_branch).toBe('feature/babysit');
+        expect(outcome.result.base_branch).toBe('main');
+        expect(outcome.result.head_sha).toBe('abc1234def5678');
+        expect(outcome.result.title).toBe('Add babysit PR feature');
+      }
+    });
+
+    it('returns head_branch, base_branch, head_sha, title for merged GitHub PR', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITHUB_MERGED_PR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { github_token: 'ghp_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('merged');
+        expect(outcome.result.head_branch).toBe('feature/merged');
+        expect(outcome.result.base_branch).toBe('main');
+        expect(outcome.result.head_sha).toBe('mergedsha123');
+        expect(outcome.result.title).toBe('Already merged PR');
+      }
+    });
+
+    it('returns head_branch, base_branch, head_sha, title for closed GitHub PR', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITHUB_CLOSED_PR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { github_token: 'ghp_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('closed');
+        expect(outcome.result.head_branch).toBe('feature/closed');
+        expect(outcome.result.base_branch).toBe('main');
+        expect(outcome.result.head_sha).toBe('closedsha123');
+      }
+    });
+
+    it('returns head_branch, base_branch, head_sha, title for open GitLab MR', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITLAB_OPEN_MR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { gitlab_token: 'glpat_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(
+        ctx,
+        'https://gitlab.com/group/project/-/merge_requests/5'
+      );
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('open');
+        expect(outcome.result.head_branch).toBe('feature/babysit');
+        expect(outcome.result.base_branch).toBe('main');
+        expect(outcome.result.head_sha).toBe('glabc1234def');
+        expect(outcome.result.title).toBe('Add babysit MR feature');
+      }
+    });
+
+    it('returns extended fields for merged GitLab MR', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITLAB_MERGED_MR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { gitlab_token: 'glpat_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(
+        ctx,
+        'https://gitlab.com/group/project/-/merge_requests/5'
+      );
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('merged');
+        expect(outcome.result.head_branch).toBe('feature/merged');
+        expect(outcome.result.base_branch).toBe('main');
+      }
+    });
+
+    it('returns extended fields for closed GitLab MR', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITLAB_CLOSED_MR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { gitlab_token: 'glpat_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(
+        ctx,
+        'https://gitlab.com/group/project/-/merge_requests/5'
+      );
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('closed');
+        expect(outcome.result.head_branch).toBe('feature/closed');
+      }
+    });
+
+    it('returns undefined extended fields when API omits them', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify({ state: 'open', merged: false }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { github_token: 'ghp_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('open');
+        expect(outcome.result.head_branch).toBeUndefined();
+        expect(outcome.result.base_branch).toBeUndefined();
+        expect(outcome.result.head_sha).toBeUndefined();
+        expect(outcome.result.title).toBeUndefined();
+      }
+    });
+
+    it('SCM API failure propagates with structured failureKind', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response('Unauthorized', { status: 401, statusText: 'Unauthorized' })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { github_token: 'ghp_bad' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(false);
+      if (!outcome.ok && outcome.error.kind === 'http_error') {
+        expect(outcome.error.status).toBe(401);
+        expect(outcome.error.provider).toBe('github');
+        expect(outcome.error.transient).toBe(false);
+      }
+    });
+
+    it('no_token error propagates with resolution chain', async () => {
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({}) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(false);
+      if (!outcome.ok && outcome.error.kind === 'no_token') {
+        expect(outcome.error.provider).toBe('github');
+        expect(outcome.error.resolutionChain.length).toBeGreaterThan(0);
+      }
+    });
+  });
+}
+
+export function registerRepoValidationTests() {
+  describe('slingExistingPr repo validation', () => {
+    it('matches GitHub PR URL to rig git_url', () => {
+      const rigCoords = parseGitUrl('https://github.com/Kilo-Org/cloud');
+      expect(rigCoords).toEqual({
+        platform: 'github',
+        owner: 'Kilo-Org',
+        repo: 'cloud',
+      });
+
+      const prUrlMatch = 'https://github.com/Kilo-Org/cloud/pull/42'.match(
+        /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/
+      );
+      expect(prUrlMatch).not.toBeNull();
+      expect(prUrlMatch![1]).toBe('Kilo-Org');
+      expect(prUrlMatch![2]).toBe('cloud');
+      expect(prUrlMatch![1]).toBe(rigCoords!.owner);
+      expect(prUrlMatch![2]).toBe(rigCoords!.repo);
+    });
+
+    it('detects repo mismatch between GitHub PR URL and rig', () => {
+      const rigCoords = parseGitUrl('https://github.com/Kilo-Org/cloud');
+      const prUrlMatch = 'https://github.com/Other-Org/cloud/pull/42'.match(
+        /^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/
+      );
+      expect(prUrlMatch).not.toBeNull();
+      expect(prUrlMatch![1]).toBe('Other-Org');
+      expect(prUrlMatch![1]).not.toBe(rigCoords!.owner);
+    });
+
+    it('detects platform mismatch (GitHub rig vs GitLab PR)', () => {
+      const rigCoords = parseGitUrl('https://github.com/Kilo-Org/cloud');
+      expect(rigCoords!.platform).toBe('github');
+
+      const glMatch = 'https://gitlab.com/Kilo-Org/cloud/-/merge_requests/7'.match(
+        /^(https:\/\/[^/]+)\/(.+)\/-\/merge_requests\/(\d+)/
+      );
+      expect(glMatch).not.toBeNull();
+    });
+
+    it('matches GitLab MR URL to rig git_url with gitlab_instance_url', () => {
+      const rigCoords = parseGitUrl(
+        'https://gitlab.mycompany.com/group/project',
+        'https://gitlab.mycompany.com'
+      );
+      expect(rigCoords).toEqual({
+        platform: 'gitlab',
+        owner: 'group',
+        repo: 'project',
+      });
+
+      const glMatch = 'https://gitlab.mycompany.com/group/project/-/merge_requests/7'.match(
+        /^(https:\/\/[^/]+)\/(.+)\/-\/merge_requests\/(\d+)/
+      );
+      expect(glMatch).not.toBeNull();
+      const fullPath = glMatch![2];
+      const lastSlash = fullPath.lastIndexOf('/');
+      const prOwner = lastSlash > 0 ? fullPath.slice(0, lastSlash) : fullPath;
+      const prRepo = lastSlash > 0 ? fullPath.slice(lastSlash + 1) : '';
+      expect(prOwner).toBe(rigCoords!.owner);
+      expect(prRepo).toBe(rigCoords!.repo);
+    });
+
+    it('rejects non-GitHub/GitLab PR URLs', () => {
+      const prUrl = 'https://example.com/some/pr/1';
+      const ghMatch = prUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+      const glMatch = prUrl.match(/^(https:\/\/[^/]+)\/(.+)\/-\/merge_requests\/(\d+)/);
+      expect(ghMatch).toBeNull();
+      expect(glMatch).toBeNull();
+    });
+
+    it('rejects non-GitLab host with /-/merge_requests/ pattern (e.g. Bitbucket)', () => {
+      const prUrl = 'https://bitbucket.org/group/project/-/merge_requests/1';
+      const ghMatch = prUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+      expect(ghMatch).toBeNull();
+      const glMatch = prUrl.match(/^(https:\/\/[^/]+)\/(.+)\/-\/merge_requests\/(\d+)/);
+      expect(glMatch).not.toBeNull();
+      const glHost = new URL(glMatch![1]).hostname;
+      expect(glHost).toBe('bitbucket.org');
+      expect(glHost !== 'gitlab.com' && glHost !== null).toBe(true);
+    });
+  });
+}
+
+export function registerStateValidationTests() {
+  describe('slingExistingPr state validation via checkPRStatus', () => {
+    beforeEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    it('checkPRStatus returns merged → slingExistingPr would refuse', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITHUB_MERGED_PR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { github_token: 'ghp_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('merged');
+      }
+    });
+
+    it('checkPRStatus returns closed → slingExistingPr would refuse', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITHUB_CLOSED_PR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { github_token: 'ghp_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('closed');
+      }
+    });
+
+    it('checkPRStatus returns open with full metadata → slingExistingPr would proceed', async () => {
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        new Response(JSON.stringify(GITHUB_OPEN_PR), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+      const ctx = mockSCMContext({
+        getTownConfig: async () => ({ git_auth: { github_token: 'ghp_test' } }) as TownConfig,
+      });
+      const outcome = await checkPRStatus(ctx, 'https://github.com/owner/repo/pull/1');
+      expect(outcome.ok).toBe(true);
+      if (outcome.ok) {
+        expect(outcome.result.status).toBe('open');
+        expect(outcome.result.head_branch).toBe('feature/babysit');
+        expect(outcome.result.base_branch).toBe('main');
+        expect(outcome.result.head_sha).toBe('abc1234def5678');
+      }
+    });
+  });
+}
diff --git a/services/gastown/test/unit/babysit-pr.test.ts b/services/gastown/test/unit/babysit-pr.test.ts
new file mode 100644
index 0000000000..c1906170c6
--- /dev/null
+++ b/services/gastown/test/unit/babysit-pr.test.ts
@@ -0,0 +1,199 @@
+import { describe, it, expect } from 'vitest';
+import { resolveForcePushAllowed } from '../../src/dos/town/agents';
+import {
+  registerCheckPRStatusTests,
+  registerRepoValidationTests,
+  registerStateValidationTests,
+} from './babysit-pr-helpers';
+
+registerCheckPRStatusTests();
+registerRepoValidationTests();
+registerStateValidationTests();
+
+describe('babysitPr tRPC mutation input validation', () => {
+  const babysitPrInputSchema = {
+    rigId: 'string-uuid',
+    prUrl: 'url',
+    title: 'string-optional',
+    body: 'string-optional',
+    forcePushAllowed: 'boolean-optional',
+  };
+
+  it('requires rigId and prUrl', () => {
+    expect(babysitPrInputSchema.rigId).toBeDefined();
+    expect(babysitPrInputSchema.prUrl).toBeDefined();
+  });
+
+  it('title, body, forcePushAllowed are optional', () => {
+    expect(babysitPrInputSchema.title).toBeDefined();
+    expect(babysitPrInputSchema.body).toBeDefined();
+    expect(babysitPrInputSchema.forcePushAllowed).toBeDefined();
+  });
+});
+
+describe('previewPr tRPC query output', () => {
+  it('returns repo_matches: false on repo mismatch without throwing', () => {
+    const result = {
+      state: 'unknown',
+      repo_matches: false,
+    };
+    expect(result.repo_matches).toBe(false);
+    expect(result.state).toBe('unknown');
+  });
+
+  it('returns full PR metadata on repo match', () => {
+    const result = {
+      state: 'open',
+      head_branch: 'feature/x',
+      base_branch: 'main',
+      head_sha: 'abc1234',
+      title: 'My PR',
+      repo_matches: true,
+    };
+    expect(result.repo_matches).toBe(true);
+    expect(result.head_branch).toBe('feature/x');
+    expect(result.base_branch).toBe('main');
+    expect(result.head_sha).toBe('abc1234');
+    expect(result.title).toBe('My PR');
+  });
+});
+
+describe('mayor-tools babysit-pr handler input schema', () => {
+  it('validates required fields', () => {
+    const body = {
+      rig_id: 'rig-1',
+      pr_url: 'https://github.com/owner/repo/pull/1',
+    };
+    expect(body.rig_id).toBeTruthy();
+    expect(body.pr_url).toMatch(/^https:\/\//);
+  });
+
+  it('sourceAgentId is forced to mayor', () => {
+    const sourceAgentId = 'mayor';
+    expect(sourceAgentId).toBe('mayor');
+  });
+});
+
+describe('refinery bypass for babysat beads', () => {
+  it('dispatch_agent returns null for babysit merge_request beads', () => {
+    const targetBead = {
+      type: 'merge_request',
+      metadata: { babysit: true },
+    };
+    const shouldBypass =
+      targetBead.type === 'merge_request' && targetBead.metadata?.babysit === true;
+    expect(shouldBypass).toBe(true);
+  });
+
+  it('dispatch_agent does NOT bypass for non-babysit merge_request beads', () => {
+    const targetBead = {
+      type: 'merge_request',
+      metadata: {},
+    };
+    const shouldBypass =
+      targetBead.type === 'merge_request' && targetBead.metadata?.babysit === true;
+    expect(shouldBypass).toBe(false);
+  });
+
+  it('dispatch_agent does NOT bypass for issue beads', () => {
+    const targetBead = {
+      type: 'issue',
+      metadata: {},
+    };
+    const shouldBypass =
+      targetBead.type === 'merge_request' && targetBead.metadata?.babysit === true;
+    expect(shouldBypass).toBe(false);
+  });
+});
+
+describe('reconciler babysit fast-track', () => {
+  it('babysat beads fast-track regardless of code_review config', () => {
+    const rigCodeReview = true;
+    const beadIsBabysat = true;
+    const shouldFastTrack = beadIsBabysat;
+    expect(shouldFastTrack).toBe(true);
+    expect(rigCodeReview).toBe(true);
+  });
+
+  it('babysat beads with pr_url transition to in_progress', () => {
+    const action = {
+      type: 'transition_bead' as const,
+      bead_id: 'test-bead',
+      from: 'open',
+      to: 'in_progress',
+      reason: 'babysat PR — skip refinery, fast-track to poll_pr',
+      actor: 'system',
+    };
+    expect(action.type).toBe('transition_bead');
+    expect(action.from).toBe('open');
+    expect(action.to).toBe('in_progress');
+    expect(action.reason).toContain('babysat');
+  });
+
+  it('non-babysat MR beads on code_review=true rig do NOT fast-track', () => {
+    const rigCodeReview = true;
+    const beadIsBabysat = false;
+    const shouldFastTrack = beadIsBabysat;
+    expect(shouldFastTrack).toBe(false);
+    expect(rigCodeReview).toBe(true);
+  });
+});
+
+describe('polecat prime context force_push_allowed gate', () => {
+  it('babysat bead with force_push_allowed: false → resolveForcePushAllowed returns false', () => {
+    const meta: Record<string, unknown> = {
+      force_push_allowed: false,
+      pr_url: 'https://github.com/o/r/pull/1',
+      branch: 'feat/x',
+      target_branch: 'main',
+    };
+    expect(resolveForcePushAllowed(meta)).toBe(false);
+  });
+
+  it('babysat bead with force_push_allowed: true → resolveForcePushAllowed returns true', () => {
+    const meta: Record<string, unknown> = {
+      force_push_allowed: true,
+      pr_url: 'https://github.com/o/r/pull/1',
+      branch: 'feat/x',
+      target_branch: 'main',
+    };
+    expect(resolveForcePushAllowed(meta)).toBe(true);
+  });
+
+  it('non-babysat bead (force_push_allowed absent) → resolveForcePushAllowed returns true (backwards compat)', () => {
+    const meta: Record<string, unknown> = {
+      pr_url: 'https://github.com/o/r/pull/1',
+      branch: 'feat/x',
+      target_branch: 'main',
+    };
+    expect(resolveForcePushAllowed(meta)).toBe(true);
+  });
+
+  it('pr_fixup_context with force_push_allowed: false surfaces correctly via resolveForcePushAllowed', () => {
+    const hookedBead: { labels: string[]; metadata: Record<string, unknown> } = {
+      labels: ['gt:pr-fixup'],
+      metadata: {
+        pr_url: 'https://github.com/o/r/pull/1',
+        branch: 'feat/x',
+        target_branch: 'main',
+        force_push_allowed: false,
+      },
+    };
+    const forcePushAllowed = resolveForcePushAllowed(hookedBead.metadata);
+    expect(forcePushAllowed).toBe(false);
+  });
+
+  it('pr_conflict_context with force_push_allowed absent surfaces as true (backwards compat)', () => {
+    const hookedBead: { labels: string[]; metadata: Record<string, unknown> } = {
+      labels: ['gt:pr-conflict'],
+      metadata: {
+        pr_url: 'https://github.com/o/r/pull/1',
+        branch: 'feat/x',
+        target_branch: 'main',
+        has_feedback: false,
+      },
+    };
+    const forcePushAllowed = resolveForcePushAllowed(hookedBead.metadata);
+    expect(forcePushAllowed).toBe(true);
+  });
+});
diff --git a/services/gastown/wrangler.jsonc b/services/gastown/wrangler.jsonc
index 1aec708d98..e3a9dff1f5 100644
--- a/services/gastown/wrangler.jsonc
+++ b/services/gastown/wrangler.jsonc
@@ -38,7 +38,7 @@
       "class_name": "TownContainerDO",
       "image": "./container/Dockerfile",
       "instance_type": "standard-4",
-      "max_instances": 500,
+      "max_instances": 700,
     },
   ],